Flyspray ADODBPath Remote File Include Vulnerability
BID:16618
Info
Flyspray ADODBPath Remote File Include Vulnerability
| Bugtraq ID: | 16618 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2006 12:00AM |
| Updated: | Feb 14 2006 06:33PM |
| Credit: | rgod is credited with the discovery of this vulnerability. |
| Vulnerable: |
Flyspray Flyspray 0.9.7 Enterprise Groupware Systems EGS 1.0 rc4 |
| Not Vulnerable: | |
Discussion
Flyspray ADODBPath Remote File Include Vulnerability
Flyspray is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
This issue is reported to affect Flyspray version 0.9.7; other versions may also be vulnerable.
EGS Enterprise Groupware System version 1.0rc4 ships with a vulnerable version of Flyspray and is also vulnerable to this issue. Other versions of EGS may also be vulnerable.
Remote file inclusion is reported to be possible on systems using PHP 5 only. However, systems using PHP 4 can still be exploited to include local files.
Flyspray is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
This issue is reported to affect Flyspray version 0.9.7; other versions may also be vulnerable.
EGS Enterprise Groupware System version 1.0rc4 ships with a vulnerable version of Flyspray and is also vulnerable to this issue. Other versions of EGS may also be vulnerable.
Remote file inclusion is reported to be possible on systems using PHP 5 only. However, systems using PHP 4 can still be exploited to include local files.
Exploit / POC
Flyspray ADODBPath Remote File Include Vulnerability
An exploit is not required.
The following proof of concept exploits for Flyspray and EGS are available:
An exploit is not required.
The following proof of concept exploits for Flyspray and EGS are available:
Solution / Fix
Flyspray ADODBPath Remote File Include Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Flyspray ADODBPath Remote File Include Vulnerability
References:
References:
- EGS Enterprise Groupware System 1.0 rc4 (possibly prior versions) remote code ex (rgod)
- EGS Homepage (Enterprise Groupware Systems)
- Flyspray Homepage (Flyspray)