KOPANEL security hole

[spamman]

sorry theoutlawtorn, the only person around that could hack my server is mo3head, and we're homies. And no I'm not giving it out.

 

[gerydeft2]

r u sure lol

 

[gerydeft2]

final fix for this vulnerability:

index.php
if (!empty($_GET['act']) && (file_exists('./' . $_GET['act'] . '.php'))) {
echo $part1;
include('./' . $_GET["act"] . '.php');

insted of this insert this:

if (!empty($_GET['act']) && (file_exists('./' . trim($_GET['act']) . '.php'))) {
echo $part1;
include('./' . trim($_GET["act"]) . '.php');

 

[theoutlawtorn]

hey i just it's older and not special version. it was shared on frmtr ( turkish forum ) but i lost it. i don't want yours of course i just want the older one

 

[xBlink]

Old topic but just wanted to say wow, good job reporting this. you could have exploited this a lot. thank you so much honest guy.

 

[spamman]

keep in mind, the fix uses heretic's test() function. If you don't have it, this "fix" won't work for you. My fix is a lil different, but here it is.

$act1= $_GET['act'];
if (($act1)!="drop")
{
$act2 = test($act1);

if (($act1) != ($act2))
{
$_GET['act'] = "";
header( 'Location: http://lostsoulzko.net' ) ;
exit;
}
}

Please note that I added an exception to it to allow the act=drop. I did this because act=drop is my drop editor . You can remove it if you want, but basically it does a small check. It gets the original $_GET value, and then runs test() on it. If it's changed, it redirects to wherever you want it to. Mine redirects to my homepage.

 

[Kr3w]

final fix for this vulnerability:

index.php
if (!empty($_GET['act']) && (file_exists('./' . $_GET['act'] . '.php'))) {
echo $part1;
include('./' . $_GET["act"] . '.php');

insted of this insert this:

if (!empty($_GET['act']) && (file_exists('./' . trim($_GET['act']) . '.php'))) {
echo $part1;
include('./' . trim($_GET["act"]) . '.php');

You realize this only removes both preceding and trailing white-spaces don't you?

Also, I'm assuming you speak of the LFI in KOPanel, and yes, the flaw exists in Apache also, but it has more to do with exploiting the default php.ini. I won't tell you how it works, however, I will give you a fix for it.

Replace your existing test() function with this one. The original test() function doesn't properly escape quoted strings, nor does it check for query breaks.

function test($str){
$mal = array(" ", "%", "\\","/","+","-","(",")","*",";");
$ret = str_replace($mal, "", $str);
$ret = str_replace("'","''",$ret);
return $ret;
}

Use the test() function on the get variable rather than trim();

Also, if you're not lazy, it would be beneficial to setup an array of allowed pages to be accessed. Who knows, maybe when I'm not lazy, one of these days I'll release a fully functional/secure KOPanel, with a USKO theme. That's on my to-do list, right after I finish my private server.