TurnkeyWebTools PHP Simple Shop Multiple Remote File Include Vulnerabilities

Bugtraq ID:	19382
Class:	Input Validation Error
CVE:	CVE-2006-4052
Remote:	Yes
Local:	No
Published:	Aug 07 2006 12:00AM
Updated:	Jul 05 2016 09:25PM
Credit:	Matdhule is credited with the discovery of these vulnerabilities.
Vulnerable:	TurnkeyWebTools PHP Simple Shop 2.0
Not Vulnerable:

TurnkeyWebTools PHP Simple Shop Multiple Remote File Include Vulnerabilities

PHP Simple Shop is prone to multiple remote file-include vulnerabilities.

An attacker can exploit these issues to execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Version 2.0 is vulnerable; other versions may also be affected.

TurnkeyWebTools PHP Simple Shop Multiple Remote File Include Vulnerabilities

Attackers can exploit these issues via a web client.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/19382-rfi.html

TurnkeyWebTools PHP Simple Shop Multiple Remote File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TurnkeyWebTools PHP Simple Shop Multiple Remote File Include Vulnerabilities

References:

• [ECHO_ADV_44$2006] PHP Simple Shop <= 2.0 (abs_path) Remote File Inclusion (Ahmad Maulana)
  
• PHP Simple Shop Product Page (TurnkeyWebTools)
  
• [ECHO_ADV_44$2006] PHP Simple Shop <= 2.0 (abs_path) Remote File Inclusion (Matdhule)