Support Incident Tracker 'translate.php' Remote Code Execution Vulnerability

Bugtraq ID:	50742
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 20 2011 12:00AM
Updated:	Nov 20 2011 12:00AM
Credit:	Egidio Romano aka EgiX
Vulnerable:	Support Incident Tracker SiT! 3.65 Support Incident Tracker SiT! 3.64 Support Incident Tracker SiT! 3.63 p1 Support Incident Tracker SiT! 3.63 Support Incident Tracker SiT! 3.62 Support Incident Tracker SiT! 3.51 Support Incident Tracker SiT! 3.50 Support Incident Tracker SiT! 3.45
Not Vulnerable:

Support Incident Tracker 'translate.php' Remote Code Execution Vulnerability

Support Incident Tracker is prone to a remote code-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow attackers to execute arbitrary PHP code within the context of the affected application.

Support Incident Tracker 3.45 to 3.65 is vulnerable; prior versions may also be affected.

Support Incident Tracker 'translate.php' Remote Code Execution Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit example is available:

• /data/vulnerabilities/exploits/50742.php

Support Incident Tracker 'translate.php' Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

Support Incident Tracker 'translate.php' Remote Code Execution Vulnerability

References:

• Support Incident Tracker Homepage (Support Incident Tracker)
  
• Support Incident Tracker <= 3.65 (translate.php) Remote Code Execution Vulnerab ([email protected])