PHP_S_Tickets_v1.3 File Inclusion Vulnerability ================================================ Discovered by N_A, N_A[at]tutanota.com ======================================= Description ============ PHP Support Tickets; will allow a webmaster the ability to offer its user base a means to contact its personell through request vouchers. https://sourceforge.net/projects/php-sup-tickets Vulnerability ============== The vulnerability resides inside the index.php file: ############ INCLUDE THE CONFIG, LANGUAGE AND HEADER FILE ############ A include('config.php'); A IF (!isset($_REQUEST['lang'])) A A A $_REQUEST['lang'] = $langdefault; A include('language/'.$_REQUEST['lang'].'.php'); A include('header.php'); We can establish that we have direct control over the 'lang' variable by either POST, GET or COOKIE method as this is allowed by PHP. By default PHP has allow_url_include disabled inside php.ini so RFI may not be possible. Exploitation ============= It is possible to execute *any* php file on the server and possibly other vhosts inside the /var/ directory or where other vhosts reside. Any php file will be executed by issuing the correct request i.e a correct directory with the php file inside that you wish to execute. Example: http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=/path/to/phpfile http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=../../../../../../tmp/phpshell *NOTE - do not issue the request for phpshell.php as the code in the file attaches .php to the end of the requested file so the file name is needed with out the .php extension. i.eA index.php?../indexA A A A - will open and execute index.php Email ====== N_A[at]tutanota.com -- Securely sent with Tutanota. Claim your encrypted mailbox today! https://tutanota.com