XAMPP 1.8.1 Local Write Access

`=============================================  
INTERNET SECURITY AUDITORS ALERT 2013-007  
- Original release date: March 14th, 2013  
- Last revised: March 19th, 2013  
- Discovered by: Manuel García Cárdenas  
- Severity: 6,8/10 (CVSS Base Score)  
- CVE-ID: CVE-2013-2586  
=============================================  
  
I. VULNERABILITY  
-------------------------  
XAMPP 1.8.1 Local Write Access Vulnerability  
  
II. BACKGROUND  
-------------------------  
XAMPP is a free and open source cross-platform web server solution stack  
package, consisting mainly of the Apache HTTP Server, MySQL database, and  
  
interpreters for scripts written in the PHP and Perl programming languages.  
  
III. DESCRIPTION  
-------------------------  
It has been detected than an unprivileged user can write in the local  
disk and the local file "lang.tmp" can be modified in the remote machine.  
  
The injection is done through the page "/xampp/lang.php".  
  
IV. PROOF OF CONCEPT  
-------------------------  
Malicious Request  
  
http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk  
  
And next, if we access to the file:  
  
http://vulnerablesite.com/xampp/lang.tmp  
  
We can verify that the file was modified.  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can execute arbitrary HTML or script code in a targeted  
user's browser, this can leverage to steal sensitive information as user  
credentials,  
  
personal data, etc.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
XAMPP 1.8.1  
  
VII. SOLUTION  
-------------------------  
All data received by the application that can be modified by the user  
must be validated.  
  
VIII. REFERENCES  
-------------------------  
http://www.apachefriends.org  
http://www.isecauditors.com  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered  
by Manuel García Cárdenas (mgarcia (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
------------------------  
March 14, 2013: Initial release  
September 26, 2013: Final release  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
March 14, 2013: Vulnerability acquired by Internet Security  
Auditors (www.isecauditors.com).  
March 16, 2013: CVE-ID received.  
March 18, 2013: Sent to Development Manager.  
August 30, 2013: New version that includes patched code.  
September 26, 2013: Sent to lists.  
  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is" with  
no warranties or guarantees of fitness of use or otherwise. Internet  
Security  
  
Auditors accepts no responsibility for any damage caused by the use or  
misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and  
  
assessing. Our clients include some of the largest companies in areas  
such as finance, telecommunications, insurance, ITC, etc. We are vendor  
independent  
  
provider with a deep expertise since 2001. Our efforts in R&D include  
vulnerability research, open security project collaboration and  
whitepapers,  
  
presentations and security events participation and promotion. For  
further information regarding our security services, contact us.  
  
XIV. FOLLOW US  
-------------------------  
You can follow Internet Security Auditors, news and security advisories at:  
https://www.facebook.com/ISecAuditors  
https://twitter.com/ISecAuditors  
http://www.linkedin.com/company/internet-security-auditors  
http://www.youtube.com/user/ISecAuditors  
`