E-Gads! Common.PHP Remote File Include Vulnerability

Bugtraq ID:	23817
Class:	Input Validation Error
CVE:	CVE-2007-2521
Remote:	Yes
Local:	No
Published:	May 04 2007 12:00AM
Updated:	May 07 2015 05:39PM
Credit:	kezzap66345 is credited with the discovery of this vulnerability.
Vulnerable:	E-GADS! E-GADS! 2.2.6
Not Vulnerable:	E-GADS! E-GADS! 2.2.7

E-Gads! Common.PHP Remote File Include Vulnerability

E-GADS! is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

E-GADS! 2.2.6 is vulnerable to this issue.

E-Gads! Common.PHP Remote File Include Vulnerability

Attackers can use a browser to exploit this issue.

An example URI has been provided:

http://www.example.com/path/common.php?locale=[[Sh3LL Script]]

E-Gads! Common.PHP Remote File Include Vulnerability

Solution:
The vendor has released version 2.2.7 to address this issue. Please see the references for more information.


E-GADS! E-GADS! 2.2.6

• E-GADS! e-gads_2.2.7.zip
  http://downloads.sourceforge.net/e-gads/e-gads_2.2.7.zip?modtime=11874 50987&big_mirror=0

E-Gads! Common.PHP Remote File Include Vulnerability

References:

• E-GADS! Web Site (E-GADS!)
  
• Release Name: e-gads_2.2.7 (E-GADS!)