RETIRED: MyBloggie Mybloggie_Root_Path Parameter Multiple Remote File Include Vulnerabilities
BID:19449
Info
RETIRED: MyBloggie Mybloggie_Root_Path Parameter Multiple Remote File Include Vulnerabilities
| Bugtraq ID: | 19449 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 02 2006 12:00AM |
| Updated: | Aug 14 2006 06:20PM |
| Credit: | sh3ll is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
myBloggie myBloggie 2.1.3 Beta myBloggie myBloggie 2.1.3 myBloggie myBloggie 2.1.2 myBloggie myBloggie 2.1.1 |
| Not Vulnerable: | |
Discussion
RETIRED: MyBloggie Mybloggie_Root_Path Parameter Multiple Remote File Include Vulnerabilities
MyBloggie is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
MyBloggie 2.1.3 and earlier are vulnerable to this issue; other versions may also be affected.
Update: Reports indicate that this is not a vulnerability because 'mybloggie_root_path' is defined as './' prior to its use in the vulnerable scripts. Therefore this BID is retired.
MyBloggie is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
MyBloggie 2.1.3 and earlier are vulnerable to this issue; other versions may also be affected.
Update: Reports indicate that this is not a vulnerability because 'mybloggie_root_path' is defined as './' prior to its use in the vulnerable scripts. Therefore this BID is retired.
Exploit / POC
RETIRED: MyBloggie Mybloggie_Root_Path Parameter Multiple Remote File Include Vulnerabilities
Attackers can exploit these issues via a web client.
The following proof-of-concept URIs are available:
Attackers can exploit these issues via a web client.
The following proof-of-concept URIs are available:
Solution / Fix
RETIRED: MyBloggie Mybloggie_Root_Path Parameter Multiple Remote File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected].
References
RETIRED: MyBloggie Mybloggie_Root_Path Parameter Multiple Remote File Include Vulnerabilities
References:
References: