South Korean UTW CMS Disclosure / Local File Inclusion / CSRF

`# Exploit Title: South Korean UTW CMS Multiple Vulnerabilities  
# Date: 18.11.2010  
# Author: Valentin  
# Category: webapps/0day  
# Version:  
  
# Tested on:  
# CVE :   
# Code :   
  
  
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]  
>> General Information   
Advisory/Exploit Title = South Korean UTW CMS Multiple Vulnerabilities  
Author = Valentin Hoebel  
Contact = [email protected]  
  
  
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]  
>> Product information  
Name = UTW CMS  
  
This product is very often used by various companies from South Korea. Googling for  
inurl:"utw_lib" shows some results, so does "utw_admin".  
The product contains a message board feature, downloads management system and  
several other community features.  
  
  
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]  
>> Local File Inclusion  
Script: utw_lib/get_file.php  
Parameters: file, rfile  
Example: utw_lib/get_file.php?rfile=<local path>&file=<local file name>  
  
The script get_file.php is vulnerable to local file inclusion attacks. Arbitrary  
files can be viewed by combining the values for the rfile and file parameters.  
  
  
>> Source Code Disclosure  
With the help of the LFI vulnerability the source code of every local script can be  
viewed.  
Example: utw_lib/get_file.php?rfile=get_file.php  
(Yes, using the rfile variable is correct here, although its purpose is to  
store a path.)  
  
This knowledge can also be used to view local configuration files.  
Example: utw_lib/get_file.php?rfile=dbinfo.inc.php  
The file dbinfo.inc.php contents the MySQL data, such as the host, database,  
user and password in plain text.  
With the help of this information it is possible to access the MySQL server.  
  
  
>> Cross-Site Request Forgery  
Every input field I saw did not filter out HTML or JavaScript code.  
I did not check if there are also XSS flaws, but there is a high chance  
that you are able to permanently inject code, e.g. in the message board threads.  
  
  
>> Low Security Levels  
Since the user data is stored in plain text (including email addresses and  
passwords), the identities of the registered userscan be stolen easily by  
accessing the MySQL database.  
  
Another aspect of this low security level is that many users use similar  
passwords for different services, e.g. often only one password for communities  
and email service logins is used.  
In this case all the user passwords and their email addresses can be dumped  
from the database and be used for trying to login to their email accounts.  
  
The admin panel can be accessed by adding /utw_admin to the URL.  
  
The product contains also a feature which makes it possible to download  
files, their download locations are stored in the database. An attack scenario  
would be to change the file downloads, so the users of the affected  
website download malicious content.  
  
  
>> External Website Rendering  
(Un)Fortunately this product is not affected by a RFI vulnerability, or at  
least I was not able to detect one. But rendering external websites in the  
context of the thrusted website is possible.  
Example: tw_lib/get_file.php?rfile=http://www,google.com  
  
This is not a real vulnerability, but can be used to abuse the thrust of the  
visitors in the affected website.  
  
  
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]  
>> Additional Information  
Advisory/Exploit Published = 18.11.2010  
  
  
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]  
>> Misc  
Greetz = cr4wl3r, JosS, Todd and Josh from packetstormsecurity.org, exploit-db.com  
  
  
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]  
`