Pearl Product Multiple Remote File Include Vulnerabilities

Bugtraq ID:	18797
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 03 2006 12:00AM
Updated:	Jul 05 2006 05:34PM
Credit:	[email protected] is credited with the discovery of these vulnerabilities.
Vulnerable:	Pearl Forums Pearl Forums 2.4 Pearl Forums Pearl For Mambo 2.4 Pearl Forums Pearl for Biz 2.4 Pearl Forums Ngoc Biec 1.4 0
Not Vulnerable:

Pearl Product Multiple Remote File Include Vulnerabilities

Various Pearl products are prone to multiple remote file-include vulnerabilities because the products fail to properly sanitize user-supplied input.

An attacker may leverage these issues to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

Pearl Product Multiple Remote File Include Vulnerabilities

These vulnerabilities can be exploited using a web browser.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/PearlProductMultipleRFIJuly032006.html

Pearl Product Multiple Remote File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please email us at: [email protected]:[email protected].

Pearl Product Multiple Remote File Include Vulnerabilities

References:

• Pearl Home Page (Pearl)
  
• Pearl Products Multiple Remote File Inclusion ([email protected])