PHP-Proxima BB_Smilies.PHP Local File Include Vulnerability

Bugtraq ID:	19840
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 04 2006 12:00AM
Updated:	Sep 06 2006 10:23PM
Credit:	Kacper is credited with the discovery of this vulnerability.
Vulnerable:	PHP-Proxima PHP-Proxima 6.0
Not Vulnerable:

PHP-Proxima BB_Smilies.PHP Local File Include Vulnerability

PHP-Proxima is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary local files from the vulnerable system in the context of the application and to execute malicious PHP code. Information obtained may aid in further attacks, including a remote compromise of the application.

PHP-Proxima version 6.0 is vulnerable to this issue; other versions may also be affected.

PHP-Proxima BB_Smilies.PHP Local File Include Vulnerability

Attackers may exploit this vulnerability via a web client.

The following exploit is available:

• /data/vulnerabilities/exploits/19840.php

PHP-Proxima BB_Smilies.PHP Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please email us at: [email protected]:[email protected].

PHP-Proxima BB_Smilies.PHP Local File Include Vulnerability

References:

• PHP-Proxima Home Page (PHP-Proxima)