Tuned Studios Multiple Webpage Templates 'index.php' Remote File Include Vulnerability

Bugtraq ID:	27196
Class:	Input Validation Error
CVE:	CVE-2008-0231
Remote:	Yes
Local:	No
Published:	Jan 09 2008 12:00AM
Updated:	Apr 16 2015 06:07PM
Credit:	Alexandr Polyakov and Stas Svistunovich are credited with the discovery of this vulnerability.
Vulnerable:	Tuned Studios Subwoofer 0 Tuned Studios Orange Cutout 0 Tuned Studios Music Theme 0 Tuned Studios Lonely Maple 0 Tuned Studios Freeze Theme 0 Tuned Studios Endless 0 Tuned Studios Classic Theme 0
Not Vulnerable:

Tuned Studios Multiple Webpage Templates 'index.php' Remote File Include Vulnerability

Multiple Tuned Studios webpage templates are prone to a remote file-include vulnerability because the applications fail to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to include and execute arbitrary remote files in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue affects the following templates:

Subwoofer
Freeze Theme
Orange Cutout
Lonely Maple
Endless
Classic Theme
Music Theme

Tuned Studios Multiple Webpage Templates 'index.php' Remote File Include Vulnerability

An attacker can use a browser to exploit this issue.

The following proof-of-concept URI is available:

http://www.example.com/[installdir]/index.php?page=../../../../../../../[file]%00

Tuned Studios Multiple Webpage Templates 'index.php' Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Tuned Studios Multiple Webpage Templates 'index.php' Remote File Include Vulnerability

References:

• Tune Studios Homepage (Tune Studios)