PHP-Generics _App_Relative_Path Multiple Remote File Include Vulnerabilities

Bugtraq ID:	23328
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 05 2007 12:00AM
Updated:	May 28 2007 05:41PM
Credit:	bd0rk is credited with the discovery of these vulnerabilities.
Vulnerable:	PHP-Generics PHP-Generics 1.0 beta
Not Vulnerable:

PHP-Generics _App_Relative_Path Multiple Remote File Include Vulnerabilities

PHP-Generics is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect version 1.0 beta; other versions may also be vulnerable.

PHP-Generics _App_Relative_Path Multiple Remote File Include Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com/[directory]/include.php?_APP_RELATIVE_PATH=[ShellCode]
http://www.example.com/[directory]/dbcommon/include.php?_APP_RELATIVE_PATH=[ShellCode]
http://www.example.com/[directory]/exception/include.php?_APP_RELATIVE_PATH=[ShellCode]

PHP-Generics _App_Relative_Path Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released version 1.0.1-beta to address this issue; please see the reference section for details.


PHP-Generics PHP-Generics 1.0 beta

• PHP-Generics php-generics-1.0.1-beta.zip
  http://downloads.sourceforge.net/php-generics/php-generics-1.0.1-beta. zip

PHP-Generics _App_Relative_Path Multiple Remote File Include Vulnerabilities

References:

• PHP-Generics Sourceforge Page (PHP-Generics)