DataLife Engine 9.7 - 'preview.php' PHP Code Injection

------------------------------------------------------------------

DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability

------------------------------------------------------------------



[-] Software Link:



http://dleviet.com/





[-] Affected Version:



9.7 only.





[-] Vulnerability Description:



The vulnerable code is located in the /engine/preview.php script:



246.	$c_list = implode (',', $_REQUEST['catlist']);

247.

248.	if( strpos( $tpl->copy_template, "[catlist=" ) !== false ) {

249.		$tpl->copy_template = preg_replace( "#\\[catlist=(.+?)\\](.*?)\\[/catlist\\]#ies", "check_category('\\1', '\\2', '{$c_list}')", $tpl->copy_template );

250.	}

251.		

252.	if( strpos( $tpl->copy_template, "[not-catlist=" ) !== false ) {

253.		$tpl->copy_template = preg_replace( "#\\[not-catlist=(.+?)\\](.*?)\\[/not-catlist\\]#ies", "check_category('\\1', '\\2', '{$c_list}', false)", $tpl->copy_template );

254.	}



User supplied input passed through the $_REQUEST['catlist'] parameter is not properly

sanitized before being used in a preg_replace() call with the e modifier at lines 249 and 253.

This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of

this vulnerability requires a template which contains a “catlist” (or a “not-catlist”) tag.





[-] Solution:



Apply the vendor patch: http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html





[-] Disclosure Timeline:



[16/01/2013] - Vendor notified

[19/01/2013] - Vendor patch released

[20/01/2013] - CVE number requested

[21/01/2013] - CVE number assigned

[28/01/2013] - Public disclosure





[-] CVE Reference:



The Common Vulnerabilities and Exposures project (cve.mitre.org)

has assigned the name CVE-2013-1412 to this vulnerability.





[-] Credits:



Vulnerability discovered by Egidio Romano.





[-] Original Advisory:



http://karmainsecurity.com/KIS-2013-01