Sugar Suite Open Source Multiple Remote and Local File Include Vulnerabilities
BID:17987
CVE-2006-2460 |Info
Sugar Suite Open Source Multiple Remote and Local File Include Vulnerabilities
| Bugtraq ID: | 17987 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 16 2006 12:00AM |
| Updated: | May 18 2006 09:08PM |
| Credit: | rgod is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
SugarCRM Sugar Suite 4.2 SugarCRM Sugar Suite 4.1 SugarCRM Sugar Suite 4.0 beta SugarCRM Sugar Suite 3.5 |
| Not Vulnerable: | |
Discussion
Sugar Suite Open Source Multiple Remote and Local File Include Vulnerabilities
Sugar Suite Open Source is prone to multiple remote and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. The attacker may also access sensitive information through the use of directory-traversal strings ('../') in the context of the webserver process.
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
Sugar Suite Open Source is prone to multiple remote and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. The attacker may also access sensitive information through the use of directory-traversal strings ('../') in the context of the webserver process.
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
Exploit / POC
Sugar Suite Open Source Multiple Remote and Local File Include Vulnerabilities
This issue can be exploited through a web client.
The following example URIs are available:
This issue can be exploited through a web client.
The following example URIs are available:
Solution / Fix
Sugar Suite Open Source Multiple Remote and Local File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]
References
Sugar Suite Open Source Multiple Remote and Local File Include Vulnerabilities
References:
References: