XMB Forum 1.6 Magic Lantern Log File Vulnerabilities

Bugtraq ID:	4722
Class:	Origin Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 11 2002 12:00AM
Updated:	May 11 2002 12:00AM
Credit:	Posted to BugTraq May 11th, 2002 by frog frog <[email protected]>
Vulnerable:	The XMB Group XMB Forum 1.6 Magic Lantern
Not Vulnerable:

XMB Forum 1.6 Magic Lantern Log File Vulnerabilities

XMB Forum 1.6 Magic Lantern allows remote users to conduct activities in the forum while bypassing normal logging functions. This is accomplished by submitting an arbitrary string as the "analized" variable to index.php. Log information is written only if this variable is empty, so submitting a string to it bypassing the logging.

In addition, log files (index_log.log and cplogfile.log) may be written with improper permissions allowing users to retrieve them with a browser.

XMB Forum 1.6 Magic Lantern Log File Vulnerabilities

/forumpath/index.php?analized=anything

XMB Forum 1.6 Magic Lantern Log File Vulnerabilities

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

XMB Forum 1.6 Magic Lantern Log File Vulnerabilities

References:

• XMB Forum Home Page (The XMB Group)