Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
BID:45290
Info
Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
| Bugtraq ID: | 45290 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 09 2010 12:00AM |
| Updated: | Dec 09 2010 12:00AM |
| Credit: | Br0ly |
| Vulnerable: |
Abtp Portal Project Abtp Portal Project 0.1 |
| Not Vulnerable: | |
Discussion
Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
Abtp Portal Project is prone to local and remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow a remote attacker to obtain sensitive information or to compromise the application and the underlying computer; other attacks are also possible.
Abtp Portal Project 0.1.0 is vulnerable; other versions may also be affected.
Abtp Portal Project is prone to local and remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow a remote attacker to obtain sensitive information or to compromise the application and the underlying computer; other attacks are also possible.
Abtp Portal Project 0.1.0 is vulnerable; other versions may also be affected.
Exploit / POC
Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
An attacker can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/Scripts/abtpportal0.1.0/includes/esqueletos/skel_null.php?ABTPV_BLOQUE_CENTRAL=[EVIL_CODE]?
http://www.example.com/Scripts/abtpportal0.1.0/includes/esqueletos/skel_null.php?ABTPV_BLOQUE_CENTRAL=/etc/passwd
An attacker can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/Scripts/abtpportal0.1.0/includes/esqueletos/skel_null.php?ABTPV_BLOQUE_CENTRAL=[EVIL_CODE]?
http://www.example.com/Scripts/abtpportal0.1.0/includes/esqueletos/skel_null.php?ABTPV_BLOQUE_CENTRAL=/etc/passwd
Solution / Fix
Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
References:
References:
- Abtp Portal Project (Abtp Portal Project)