Simple PHP Newsletter 'olang' Parameter Multiple Local File Include Vulnerabilities

Bugtraq ID:	33327
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 16 2009 12:00AM
Updated:	Jan 19 2009 06:52PM
Credit:	ahmadbady
Vulnerable:	Quirm Simple PHP Newsletter 1.5
Not Vulnerable:

Simple PHP Newsletter 'olang' Parameter Multiple Local File Include Vulnerabilities

Simple PHP Newsletter is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

Simple PHP Newsletter 1.5 is affected; other versions may also be vulnerable.

Simple PHP Newsletter 'olang' Parameter Multiple Local File Include Vulnerabilities

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com/path/mail.php?olang=../../../../../../etc/passwd
http://www.example.com/path/mailbar.php?olang=../../../../../../etc/passwd

Simple PHP Newsletter 'olang' Parameter Multiple Local File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Simple PHP Newsletter 'olang' Parameter Multiple Local File Include Vulnerabilities

References:

• Quirm Homepage (Quirm)