____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/

                                        .OR.ID
ECHO_ADV_28$2006

---------------------------------------------------------------------------
[ECHO_ADV_28$2006] Clever Copy <= 3.0 Connect.inc Critical Information
Disclosure
---------------------------------------------------------------------------

Author       : M.Hasran Addahroni
Date         : April, 7th 2006
Location     : Indonesia, Bali
Web          : http://advisories.echo.or.id/adv/adv28-K-159-2006.txt
Critical Lvl : Medium
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : Clever Copy
version     : 3.0
URL         : http://clevercopy.bestdirectbuy.com/
Description :

Clever Copy is a free, fully scalable web site portal and news posting
system. You can run it as a very simple blog or ramp it up to a full
Content Management System.
It is easy to setup, use and maintain requiring
no previous knowledge of web portals, blogs, php, Cms's or databases.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~~~
Critical connect.inc file in admin folder are vulnerable to direct access
to view 'critical' information about the database username and password.

------------------connect.inc-----------------------------------
<?php
..
//ENTER THE SETTINGS FOR THE CONNECTION TO YOUR DATABASE BELOW
$Host = "localhost"; // The hostname for your server. localhost works for
most database servers or you may have to contact your hosts if you don't
know
$Dbase = "clevercopy"; // The name of your database on your database server
$User = "test";  // The username required to connect to your database
$Pass = "test123"; // The password required to connect to your database
..
?>
------------------------------------------------------------------

Its works when file *.inc not declare in httpd.conf.

Poc:
~~~~~~~~~~~~

http://www.example.com/[clevercopy_path]/admin/connect.inc

Solution:
~~~~~~~~~

rename connect.inc into connect.inc.php to protect this vulnerability or
declare *.inc in httpd.conf

---------------------------------------------------------------------------
Shoutz:
~~~~~~~

~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous,kaiten
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,x`shell,tety,sakitjiwa, m_beben, rizal, cR4SH3R, metalsploit,FeNNi
~ newbie_hacker@yahoogroups.com
~ #aikmel #e-c-h-o @irc.dal.net
---------------------------------------------------------------------------
Contact:
~~~~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------