phpRechnung 'include/phprechnung.inc.php' Multiple Security Bypass Vulnerabilities

Bugtraq ID:	45306
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 09 2010 12:00AM
Updated:	Dec 09 2010 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	phpRechnung phpRechnung 1.5.2 phpRechnung phpRechnung 1.6
Not Vulnerable:	phpRechnung phpRechnung 1.6.1

phpRechnung 'include/phprechnung.inc.php' Multiple Security Bypass Vulnerabilities

phpRechnung is prone to multiple security-bypass vulnerabilities because the application fails to properly control access to some pages.

Attackers can exploit these issues to bypass certain security restrictions and modify application settings or to execute arbitrary code.

Versions prior to phpRechnung 1.6.1 are vulnerable.

phpRechnung 'include/phprechnung.inc.php' Multiple Security Bypass Vulnerabilities

Attackers can use a browser to exploit these issues.

phpRechnung 'include/phprechnung.inc.php' Multiple Security Bypass Vulnerabilities

Solution:
Updates are available; please see the references for more information.

phpRechnung 'include/phprechnung.inc.php' Multiple Security Bypass Vulnerabilities

References:

• phpRechnung Homepage (Edy Corak)
  
• phpRechnung - ChangeLog (Edy Corak)