Randshop DateiPfad Parameter Remote File Include Vulnerability

Bugtraq ID:	18865
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 06 2006 12:00AM
Updated:	Jul 07 2006 02:49PM
Credit:	Saudi Hackrz is credited with the discovery of this vulnerability.
Vulnerable:	Randshop Randshop 1.1.1 Randshop Randshop 0.9.3 Randshop Randshop 1.2 Randshop Randshop
Not Vulnerable:

Randshop DateiPfad Parameter Remote File Include Vulnerability

Randshop is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Randshop DateiPfad Parameter Remote File Include Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/randshop-jun-6-2006.txt

Randshop DateiPfad Parameter Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].

Randshop DateiPfad Parameter Remote File Include Vulnerability

References:

• Randshop Web Site (Randshop)