Sourdough 'neededFiles[patForms]' Parameter Remote File Include Vulnerability

Bugtraq ID:	33569
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 02 2009 12:00AM
Updated:	Feb 03 2009 10:49PM
Credit:	ahmadbady
Vulnerable:	Sourdough Sourdough 0.3.5
Not Vulnerable:

Sourdough 'neededFiles[patForms]' Parameter Remote File Include Vulnerability

Sourdough is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Sourdough 0.3.5 is vulnerable; other versions may also be affected.

Sourdough 'neededFiles[patForms]' Parameter Remote File Include Vulnerability

Attackers can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/thirdparty/patForms/examples/example_clientside_javascript.php?neededFiles[patForms]=shell.txt?

Sourdough 'neededFiles[patForms]' Parameter Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sourdough 'neededFiles[patForms]' Parameter Remote File Include Vulnerability

References:

• Sourdough Homepage (Sourdough)