SourceBans Local File Include and SQL Injection Vulnerabilities

Bugtraq ID:	50948
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2011 12:00AM
Updated:	Dec 07 2011 12:00AM
Credit:	Havok
Vulnerable:
Not Vulnerable:

SourceBans Local File Include and SQL Injection Vulnerabilities

SourceBans is prone to a local file-include vulnerability and an SQL-injection vulnerability.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.

SourceBans 1.4.8 and prior versions are vulnerable.

SourceBans Local File Include and SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs are available:

http://www.example.com/index.php?xajax=RefreshServer&xajaxargs[]=1'[SQL]
http://www.example.com/index.php?xajax=SelTheme&xajaxargs[]=../../../../../../../../../../etc/passwd%00

SourceBans Local File Include and SQL Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SourceBans Local File Include and SQL Injection Vulnerabilities

References:

• SourceBans - Homepage (GameConnect)