F3Site 'GLOBALS[nlang]' Parameter Multiple Local File Include Vulnerabilities

Bugtraq ID:	37408
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 18 2009 12:00AM
Updated:	Dec 19 2009 12:43AM
Credit:	cr4wl3r
Vulnerable:	F3Site F3Site 2009
Not Vulnerable:

F3Site 'GLOBALS[nlang]' Parameter Multiple Local File Include Vulnerabilities

F3Site is prone to multiple local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

F3Site 2009 is vulnerable; other versions may also be affected.

F3Site 'GLOBALS[nlang]' Parameter Multiple Local File Include Vulnerabilities

An attacker can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/mod/poll.php?GLOBALS[nlang]=[LFI%00]
http://www.example.com/mod/new.php?GLOBALS[nlang]=[LFI%00]

F3Site 'GLOBALS[nlang]' Parameter Multiple Local File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any recent information, please mail us at: [email protected].

F3Site 'GLOBALS[nlang]' Parameter Multiple Local File Include Vulnerabilities

References:

• Vendor Homepage (F3Site)