Unclassified NewsBoard ABBC.CSS.PHP Local File Include Vulnerability

Bugtraq ID:	17947
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 11 2006 12:00AM
Updated:	May 15 2006 07:44PM
Credit:	rgod is credited with the discovery of this vulnerability.
Vulnerable:	Unclassified NewsBoard Unclassified NewsBoard 1.6.1 Unclassified NewsBoard Unclassified NewsBoard 1.5.3 a Unclassified NewsBoard Unclassified NewsBoard 1.5.3
Not Vulnerable:

Unclassified NewsBoard ABBC.CSS.PHP Local File Include Vulnerability

Unclassified NewsBoard is prone to a local file-include vulnerability. This may allow unauthorized users to view files and to execute local scripts.

A successful exploit may allow unauthorized users to view files and to execute local scripts; other attacks are also possible.

Versions 1.6.1 and earlier are reported vulnerable to this issue.

Unclassified NewsBoard ABBC.CSS.PHP Local File Include Vulnerability

This issue can be exploited through a web client.

The following exploit is available:

• /data/vulnerabilities/exploits/unclassifiednewsboard-lteq1.6.1-lfi.txt

Unclassified NewsBoard ABBC.CSS.PHP Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Unclassified NewsBoard ABBC.CSS.PHP Local File Include Vulnerability

References:

• Unclassified NewsBoard Web Page (Unclassified NewsBoard)
  
• Unclassified NewsBoard <= 1.6.1 patch 1 ABBC[Config][smileset] arbitrary local i ([email protected])