Ascended Guestbook Embedded.PHP Remote File Include Vulnerability

Bugtraq ID:	20710
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 24 2006 12:00AM
Updated:	Oct 30 2006 09:13PM
Credit:	Kacper is credited with the discovery of this vulnerability.
Vulnerable:	Ascended Development Ascended Guestbook 1.0
Not Vulnerable:	Ascended Development Ascended Guestbook 1.0.1

Ascended Guestbook Embedded.PHP Remote File Include Vulnerability

Ascended Guestbook is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Ascended Guestbook 1.0.0 and prior versions are vulnerable to this issue.

Ascended Guestbook Embedded.PHP Remote File Include Vulnerability

Attackers can exploit this issue via a web client.

The following proof of concept is available:

• /data/vulnerabilities/exploits/20710.php

Ascended Guestbook Embedded.PHP Remote File Include Vulnerability

Solution:
This issue has been addressed in version 1.0.1 and later.


Ascended Development Ascended Guestbook 1.0

• Ascended Development aguestbook-v1.0.2.tar
  http://download.ascdevel.com/download.php?v=latest&p=3&t=tar

Ascended Guestbook Embedded.PHP Remote File Include Vulnerability

References:

• Ascended Development (Ascended Development)
  
• Ascended Guestbook v1.0.1 (Ascended Guestbook)