CF_Nuke Index.CFM Local File Include Vulnerability

Bugtraq ID:	15777
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 08 2005 12:00AM
Updated:	Dec 08 2005 12:00AM
Credit:	r0t is credited with the discovery of this vulnerability.
Vulnerable:	CF_Nuke CF_Nuke 4.6
Not Vulnerable:

CF_Nuke Index.CFM Local File Include Vulnerability

CF_Nuke is prone to a local file include vulnerability. This is due to a lack of sanitization of user-supplied input.

This may facilitate the unauthorized viewing of files and unauthorized execution of local ColdFusion code.

It should be noted that successful exploitation requires that "Sandbox Security" is not enabled for the directory.

CF_Nuke 4.6 and prior versions are reported to be vulnerable; other versions may also be affected.

CF_Nuke Index.CFM Local File Include Vulnerability

No exploit is required.

Example URI have been provided:

http://www.example.com/index.cfm?sector=../local file

http://www.example.com/index.cfm?sector=quotes&page=../local file

CF_Nuke Index.CFM Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CF_Nuke Index.CFM Local File Include Vulnerability

References:

• CF_Nuke v4.6 Multiple vuln. (r0t)
  
• CF_Nuke Web Site (CF_Nuke)