RETIRED: Drupal 'install.php' Local File Include Vulnerability
BID:33685
Info
RETIRED: Drupal 'install.php' Local File Include Vulnerability
| Bugtraq ID: | 33685 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 09 2009 12:00AM |
| Updated: | Feb 18 2009 04:58PM |
| Credit: | Rasool Nasr |
| Vulnerable: |
Drupal Drupal 6.9 |
| Not Vulnerable: | |
Discussion
RETIRED: Drupal 'install.php' Local File Include Vulnerability
Drupal is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.
Drupal 6.9 is vulnerable; other versions may also be affected.
UPDATE (February 12, 2009): The vendor indicates that they cannot reproduce this issue. We will update this BID further as more information emerges.
UPDATE (February 18, 2009): The vendor indicates that the issue is not exploitable as described. This BID is retired.
Drupal is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.
Drupal 6.9 is vulnerable; other versions may also be affected.
UPDATE (February 12, 2009): The vendor indicates that they cannot reproduce this issue. We will update this BID further as more information emerges.
UPDATE (February 18, 2009): The vendor indicates that the issue is not exploitable as described. This BID is retired.
Exploit / POC
RETIRED: Drupal 'install.php' Local File Include Vulnerability
Attackers can exploit this issue via a browser.
The following example URI is available:
http://www.example.com/drupal/install.php?profile=[shell code]%00
Attackers can exploit this issue via a browser.
The following example URI is available:
http://www.example.com/drupal/install.php?profile=[shell code]%00
Solution / Fix
RETIRED: Drupal 'install.php' Local File Include Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RETIRED: Drupal 'install.php' Local File Include Vulnerability
References:
References: