KGB Sesskglogadmin.PHP Local File Include Vulnerability
BID:22065
Info
KGB Sesskglogadmin.PHP Local File Include Vulnerability
| Bugtraq ID: | 22065 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-0337 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 15 2007 12:00AM |
| Updated: | Jan 25 2007 04:22PM |
| Credit: | Kacper is credited with the discovery of this vulnerability. |
| Vulnerable: |
KGB KGB 1.9 |
| Not Vulnerable: | |
Discussion
KGB Sesskglogadmin.PHP Local File Include Vulnerability
KGB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
A remote attacker can exploit this vulnerability to include an arbitrary local file in the context of the webserver process. By using the comment system, an attacker may be able to exploit this issue to execute arbitrary code. Other attacks may also be possible.
This issue affects version 1.9; other versions may also be vulnerable.
KGB is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
A remote attacker can exploit this vulnerability to include an arbitrary local file in the context of the webserver process. By using the comment system, an attacker may be able to exploit this issue to execute arbitrary code. Other attacks may also be possible.
This issue affects version 1.9; other versions may also be vulnerable.
Exploit / POC
KGB Sesskglogadmin.PHP Local File Include Vulnerability
Attackers can exploit this issue via a web client.
The following exploit is available:
Attackers can exploit this issue via a web client.
The following exploit is available:
Solution / Fix
KGB Sesskglogadmin.PHP Local File Include Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].