Open Conference Systsems Fullpath Remote File Include Vulnerability

Bugtraq ID:	20567
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 16 2006 12:00AM
Updated:	Oct 17 2006 08:29PM
Credit:	k1tk4t is credited with the discovery of this vulnerability.
Vulnerable:	Open Conference Systems Open Conference Systems 1.1.3
Not Vulnerable:	Open Conference Systems Open Conference Systems 1.1.6

Open Conference Systsems Fullpath Remote File Include Vulnerability

Open Conference Systems is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 1.1.3 is vulnerable to this issue. Other versions may be affected as well.

Open Conference Systsems Fullpath Remote File Include Vulnerability

Attackers can exploit this issue via a web browser.

Open Conference Systsems Fullpath Remote File Include Vulnerability

Solution:
The vendor has released an update that addresses this issue.

Please see the vendor references for more information.


Open Conference Systems Open Conference Systems 1.1.3

• Open Conference Systems OPen Conference Systems 1.1.6
  http://pkp.sfu.ca/ocs/download/ocs-1.1.6.tar.gz

Open Conference Systsems Fullpath Remote File Include Vulnerability

References:

• Vendor Homepage (Open Conference Systems)