title: Arbitrary File Inclusion in phpCMS 1.2.x
program: phpCMS
vulnerable version: 1.2.0, 1.2.1, 1.2.1pl1
homepage: www.phpcms.de
found: 2005-05-31
by: sk0L / SEC-CONSULT / www.sec-consult.com
=======================================================================
phpCMS is a content management system, which convinces in particular by
small
system requirements, high performance and above all its flexibility.
a flaw in phpCMS makes it possible to include arbitrary files on the server.
as the "include" statement is called before any session checks occur,
this vuln
can be exploited without any prior authentication.
the vulnerable include call resides in class.layout_phpcms.php:
if(isset($_GET['language']) && $_GET['language'] != '') {
include($PHPCMS_INCLUDEPATH.'/language.'.$_GET[language]);
[…]
so you are able to do something like:
according to Ignatius from the phpCMS Core Team, the vulnerable code
line was introduced in phpCMS 1.2.0. older versions are not affected by
this vulnerabity.
vendor notified: 2005-05-31
vendor response: immediately
patch available: 2005-06-01
the vulnerabilty has been adressed in phpCMS 1.2.1pl2. additionally,
patches for the affected versions have been made available by the vendor.
http://www.phpcms.de/download/
Bernhard Mueller / www.sec-consult.com /
SGT ::: dfa, tke, bfi, mei, flo, walter|bruder :::
~ ___ ___
~ | |=|_.' .'| .'| .'|=|`. .'|
~ `. | .' | .' .' .' | | `. .' |
==== `.|=|`. | |=|.: | | | | | | ======
~ ___ | `.| | |'. `. | | .' | | ___
~ `._|=|___||___| |_| `.|=|.' |___|=|_.
-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/