Pivot Multiple Input Validation Vulnerabilities

Bugtraq ID:	18881
Class:	Input Validation Error
CVE:	CVE-2006-3533 CVE-2006-3532 CVE-2006-3531
Remote:	Yes
Local:	Yes
Published:	Jul 07 2006 12:00AM
Updated:	Jan 16 2007 06:00PM
Credit:	rgod is credited with the discovery of these vulnerabilities.
Vulnerable:	Pivot Pivot 1.3.0 RC2
Not Vulnerable:	Pivot Pivot 1.3

Pivot Multiple Input Validation Vulnerabilities

Pivot is prone to multiple input-validation vulnerabilities, including remote file-include, local file-include, cross-site scripting, and privilege-escalation issues. All of these issues are due to a failure in the application to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, execute remote PHP code in the context of the webserver process, and gain unauthorized privileges.

Pivot 1.30 RC2 and prior versions are vulnerable to this issue.

Pivot Multiple Input Validation Vulnerabilities

Attackers can exploit these issues through a web client.

The following proof of concept is available:

• /data/vulnerabilities/exploits/PivotMultipleInputJuly072006.html

Pivot Multiple Input Validation Vulnerabilities

Solution:
The vendor fixed these issues in version 1.30. Please see the references for details.

Pivot Multiple Input Validation Vulnerabilities

References:

• Pivot Changelog 1.30 (Pivot)
  
• Pivot Homepage (Pivot)
  
• Pivot <=1.30rc2 privilege escalation/remote commands execution ([email protected])