Maia Mailguard Login.PHP Multiple Local File Include Vulnerabilities

Bugtraq ID:	24770
Class:	Input Validation Error
CVE:	CVE-2007-3619
Remote:	Yes
Local:	No
Published:	Jul 05 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Adriel T. Desautels of Netragard and David Morton are credited with the discovery of these vulnerabilities.
Vulnerable:	Maia Mailguard 1.0.2
Not Vulnerable:

Maia Mailguard Login.PHP Multiple Local File Include Vulnerabilities

Maia Mailguard is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an unauthorized user to view files and execute local scripts.

These issues affects Maia Mailguard 1.0.2 and prior versions.

Maia Mailguard Login.PHP Multiple Local File Include Vulnerabilities

Attackers may exploit these issues through a browser.

The following proof-of-concept URI is available:

http://www.example.com/maia/login.php?lang=../../../../../../../../../../../../../var/log/httpd-error.log%00.txt

Maia Mailguard Login.PHP Multiple Local File Include Vulnerabilities

Solution:
The vendor released a patch to address these issues. Please see the references for more information.


Maia Mailguard 1.0.2

• Maia xlogin.php
  http://www.maiamailguard.org/maia/changeset/1184?format=diff&new=1184

Maia Mailguard Login.PHP Multiple Local File Include Vulnerabilities

References:

• Maia Mailguard Home Page (Maia Mailguard)
  
• Ticket #479: directory traversal and file read (David Morton)