PHProjekt Include Path Multiple Remote File Include Vulnerabilities

Bugtraq ID:	20268
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 29 2006 12:00AM
Updated:	Sep 29 2006 09:15PM
Credit:	Discovery is credited to Stefan Esser.
Vulnerable:	PHProjekt PHProjekt 5.1.1
Not Vulnerable:	PHProjekt PHProjekt 5.1.2

PHProjekt Include Path Multiple Remote File Include Vulnerabilities

Multiple remote file-include vulnerabilities affect PHProjekt because the application fails to properly sanitize user-supplied input before using it in a PHP 'include()' function call.

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process.

Version 5.1.1 of PHProjekt is vulnerable to these issues; previous versions may be affected as well.

PHProjekt Include Path Multiple Remote File Include Vulnerabilities

Attackers can exploit this issue using a web client.

PHProjekt Include Path Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released version 5.1.2 to address these issues.

Please see the referenced advisories for more information.


PHProjekt PHProjekt 5.1.1

• PHProjekt phprojekt.tar.gz
  http://www.phprojekt.com/download/phprojekt.tar.gz

PHProjekt Include Path Multiple Remote File Include Vulnerabilities

References:

• PHProjekt Homepage (PHProjekt Team)
  
• Advisory 06/2006: PHProjekt (Remote) Include Vulnerabilities (Stefan Esser )