Fire Soft Board Demarrage.PHP Remote File Include Vulnerability

Bugtraq ID:	19899
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2006 12:00AM
Updated:	Sep 08 2006 04:37PM
Credit:	ERNE is credited with the discovery of this vulnerability.
Vulnerable:	Fire Soft Board Fire Soft Board RC3
Not Vulnerable:

Fire Soft Board Demarrage.PHP Remote File Include Vulnerability

Fire-Soft-Board is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to have malicious PHP code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version RC3 is vulnerable; other versions may also be affected.

Fire Soft Board Demarrage.PHP Remote File Include Vulnerability

An attacker can exploit this issue using a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/19899.html

Fire Soft Board Demarrage.PHP Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Fire Soft Board Demarrage.PHP Remote File Include Vulnerability

References:

• Vendor Homepage (Fire Soft Board)