PHPLinks Multiple Input Validation Vulnerabilities
BID:11329
Info
PHPLinks Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 11329 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 05 2004 12:00AM |
| Updated: | Oct 05 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to LSS Security <[email protected]>. |
| Vulnerable: |
phpLinks phpLinks 2.1.3 1 phpLinks phpLinks 2.1.2 |
| Not Vulnerable: | |
Discussion
PHPLinks Multiple Input Validation Vulnerabilities
PHPLinks is reported prone to multiple input validation vulnerabilities.
A file include vulnerability is reported to affect the 'index.php' script. This may allow an attacker to include and execute arbitrary PHP scripts. Code execution will occur in the context of the web server process that is hosting the vulnerable script.
SQL injection issues are reported to exist in the application as well. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.
PHPLinks is reported prone to multiple input validation vulnerabilities.
A file include vulnerability is reported to affect the 'index.php' script. This may allow an attacker to include and execute arbitrary PHP scripts. Code execution will occur in the context of the web server process that is hosting the vulnerable script.
SQL injection issues are reported to exist in the application as well. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.
Exploit / POC
PHPLinks Multiple Input Validation Vulnerabilities
The following examples are available:
www.example.com/phplinks/index.php?show=../../../../../../some/some/execute
The following examples are available:
www.example.com/phplinks/index.php?show=../../../../../../some/some/execute
Solution / Fix
PHPLinks Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHPLinks Multiple Input Validation Vulnerabilities
References:
References:
- phpLinks Homepage (phpLinks)
- Re: Full path disclosure in PHP Links - more (LSS Security