BPowerHouse Mini Blog 'index.php' Multiple Local File Include Vulnerabilities

Bugtraq ID:	32677
Class:	Input Validation Error
CVE:	CVE-2008-5594
Remote:	Yes
Local:	No
Published:	Dec 07 2008 12:00AM
Updated:	Dec 18 2008 11:32PM
Credit:	cOndemned
Vulnerable:	BPowerHouse Mini Blog 1.0.1
Not Vulnerable:

BPowerHouse Mini Blog 'index.php' Multiple Local File Include Vulnerabilities

BPowerHouse Mini Blog is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

Mini Blog 1.0.1 is vulnerable; other versions may also be affected.

BPowerHouse Mini Blog 'index.php' Multiple Local File Include Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/[mini_blog_1.0.1_path]/index.php?page=../../../../[local_file]%00
http://www.example.com/[mini_blog_1.0.1_path]/index.php?admin=../../../../[local_file]%00

BPowerHouse Mini Blog 'index.php' Multiple Local File Include Vulnerabilities

Solution:
The vendor indicates that these issues have been patched. Please contact the vendor for details.

BPowerHouse Mini Blog 'index.php' Multiple Local File Include Vulnerabilities

References:

• Mini Blog Homepage (BPowerHouse)