Open-Realty 2.5.8 Local File Inclusion

`1. OVERVIEW  
  
Open-Realty 2.5.8 and lower versions are vulnerable to Local File Inclusion.  
  
  
2. BACKGROUND  
  
Open-Realty is the world's leading real estate listing marketing and  
management CMS application, and has enjoyed being the real estate web  
site software of choice for professional web site developers since  
2002.  
  
  
3. VULNERABILITY DESCRIPTION  
  
Open-Realty contains a flaw that may allow a remote attacker to  
execute arbitrary commands or code. The issue is due to the  
'index.php' script not properly sanitizing user input, specifically  
directory traversal style attacks (e.g., ../../) supplied to the  
'select_users_template' parameter. This may allow an attacker to  
include a file from the targeted host that contains arbitrary commands  
or code that will be executed by the vulnerable script. Such attacks  
are limited due to the script only calling files already on the target  
host. In addition, this flaw can potentially be used to disclose the  
contents of any file on the system accessible by the web server.  
  
  
4. VERSIONS AFFECTED  
  
2.5.8 (2.x.x) <=  
  
  
5. PROOF-OF-CONCEPT/EXPLOIT  
  
http://localhost/open-realty2.5.8/?select_users_template=../../../../../../../../../../../../../../../etc/passwd%00  
  
  
6. SOLUTION  
  
The version 2.5.x version family is no longer maintained by the vendor.  
The version 3.x.x is not found to be vulnerable to this issue. Upgrade  
to the latest 3.x.x version.  
  
  
7. VENDOR  
  
Transparent Technologies Inc.  
http://www.transparent-support.com  
  
  
8. CREDIT  
  
Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.  
  
  
9. DISCLOSURE TIME-LINE  
  
2012-03-05: Open-Realty 2.5.8 in End-of-Support/Maintenance circle  
2012-03-05: Vulnerability disclosed  
  
  
10. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_2.5.8_2.x%5D_lfi  
Open-Realty Home Page: http://www.open-realty.org/  
CWE-98: Improper Control of Filename for Include/Require Statement in  
PHP Program ('PHP File Inclusion')  
CAPEC-252: PHP Local File Inclusion  
  
  
#yehg [2012-03-05]  
`