TinyPHPForum Profile.PHP Local File Include Vulnerability

Bugtraq ID:	18304
Class:	Input Validation Error
CVE:	CVE-2006-7063
Remote:	Yes
Local:	No
Published:	Jun 06 2006 12:00AM
Updated:	Jul 06 2016 02:40PM
Credit:	Hessam-x <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	TinyPHPForum TinyPHPForum 3.6
Not Vulnerable:

TinyPHPForum Profile.PHP Local File Include Vulnerability

TinyPHPForum is prone to a local file-include vulnerability. This is due to improper sanitization of user-supplied input.

A successful exploit may allow unauthorized users to view files and to execute local scripts; other attacks are also possible.

Version 3.6 of TinyPHPForum is vulnerable to this issue; other versions may also be affected.

TinyPHPForum Profile.PHP Local File Include Vulnerability

This issue can be exploited through a web client.

An exploit demonstrating this issue is available:

• /data/vulnerabilities/exploits/18304.pl

TinyPHPForum Profile.PHP Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

TinyPHPForum Profile.PHP Local File Include Vulnerability

References:

• TinyPHPForum Homepage (TinyPHPForum)