phpWebSite contains a flaw that may allow a malicious user to force an administrator to execute malicious code. The issue is triggered when a malicious user sends specially crafted code to an administrator which forces commands to be executed via POST requests instead of GET requests, bypassing some authentication checks. It is possible that the flaw may allow a remote attacker to create an adminsitrative account and/or take over the system resulting in a loss of confidentiality and/or integrity.

Currently, there are no known workarounds or upgrades to correct this issue. However, phpWebSite developers have released a patch to address this vulnerability.

• Security Tracker: 1011120
• Related OSVDB ID: 9444 9445 9446
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-09/0008.html
• Vendor URL: http://phpwebsite.appstate.edu/
• Other Advisory URL: http://www.gulftech.org/?node=research&article_id=00048-08312004
• Vendor Specific Advisory URL: http://www.phpwebsite.appstate.edu/index.php?module=announce&ANN_user_op=view&ANN_id=822

• James Bercegay - securitygulftech.org - GulfTech Security Research

We currently have no CVSS2 data on this vulnerability. Feel free to suggest it.