Pligg CMS Multiple Security Vulnerabilities

Bugtraq ID:	46998
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Mar 23 2011 12:00AM
Updated:	Mar 31 2011 06:15PM
Credit:	sitewat.ch and other unspecified third-party researchers, Jelmer de Hen
Vulnerable:	Pligg Pligg CMS 1.1.3 Pligg Pligg CMS 1.1.2
Not Vulnerable:	Pligg Pligg CMS 1.1.4

Pligg CMS Multiple Security Vulnerabilities

Pligg CMS is prone to multiple security vulnerabilities because it fails to properly sanitize user-supplied input. These vulnerabilities include a local file-include vulnerability, a security-bypass vulnerability, and an authentication-bypass vulnerability.

Attackers can exploit these issues to view and execute arbitrary local files in the context of the webserver process, bypass security-restrictions, and perform unauthorized actions.

Versions prior to Pligg CMS 1.1.4 are vulnerable.

Pligg CMS Multiple Security Vulnerabilities

Attackers can exploit these issues through a browser.

The following exploits are available:

• /data/vulnerabilities/exploits/46998.txt

Pligg CMS Multiple Security Vulnerabilities

Solution:
The vendor has released a fix. Please see the references for more information.

Pligg CMS Multiple Security Vulnerabilities

References:

• Pligg CMS - Homepage (Pligg)
  
• Pligg CMS 1.1.4 Release (Pligg)
  
• The Pligg CMS 0dayset #1 (Jelmer)