bugtraq - SEC-CONSULT SA20050602-1 :: Arbitrary File Inclusion in phpCMS 1.2.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 02 Jun 2005 09:44:09 +0200
From: "Bernhard Müller" <bmu@...-consult.com>
To: bugtraq@...urityfocus.com
Subject: SEC-CONSULT SA20050602-1 :: Arbitrary File Inclusion in phpCMS 1.2.x

SEC-CONSULT Security Advisory 20050602-1
=======================================================================
                  title: Arbitrary File Inclusion in phpCMS 1.2.x
                program: phpCMS
     vulnerable version: 1.2.0, 1.2.1, 1.2.1pl1
               homepage: www.phpcms.de
                  found: 2005-05-31
                     by: sk0L / SEC-CONSULT / www.sec-consult.com
=======================================================================

vendor description:
---------------
phpCMS is a content management system, which convinces in particular by
small
system requirements, high performance and above all its flexibility.


vulnerabilty overview:
---------------
a flaw in phpCMS makes it possible to include arbitrary files on the server.
as the "include" statement is called before any session checks occur,
this vuln
can be exploited without any prior authentication.


proof of concept:
---------------

the vulnerable include call resides in class.layout_phpcms.php:

if(isset($_GET['language']) && $_GET['language'] != '') {
    include($PHPCMS_INCLUDEPATH.'/language.'.$_GET[language]);
[...]

so you are able to do something like:

http://vu1n.com/parser/parser.php?&phpcmsaction=FILEMANAGER&language=de/../../../../../../../etc/passwd


vulnerable versions:
---------------

according to Ignatius from the phpCMS Core Team, the vulnerable code
line was introduced in phpCMS 1.2.0. older versions are not affected by
this vulnerabity.


vendor status:
---------------
vendor notified: 2005-05-31
vendor response: immediately
patch available: 2005-06-01

the vulnerabilty has been adressed in phpCMS 1.2.1pl2. additionally,
patches for the affected versions have been made available by the vendor.

http://www.phpcms.de/download/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Bernhard Mueller / www.sec-consult.com /
SGT ::: dfa, tke, bfi, mei, flo, walter|bruder :::

~    ___   ___
~   |   |=|_.'   .'|   .'|   .'|=|`.     .'|
~   `.  |      .'  | .' .' .'  | |  `. .'  |
 ==== `.|=|`.  |   |=|.:   |   | |   | |   |  ======
~    ___  |  `.|   |   |'. `.  | |  .' |   |  ___
~    `._|=|___||___|   |_|   `.|=|.'   |___|=|_.
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-


Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (3380 bytes)