YaBB 'guestlanguage' Cookie Parameter Local File Include Vulnerability

Bugtraq ID:	59643
Class:	Input Validation Error
CVE:	CVE-2013-2057
Remote:	Yes
Local:	No
Published:	May 04 2013 12:00AM
Updated:	May 04 2013 12:00AM
Credit:	John Lightsey
Vulnerable:	YaBB YaBB 2.5.2 YaBB YaBB 2.5
Not Vulnerable:

YaBB 'guestlanguage' Cookie Parameter Local File Include Vulnerability

YaBB is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

YaBB 2.5.2 and prior versions are vulnerable.

YaBB 'guestlanguage' Cookie Parameter Local File Include Vulnerability

An attacker can exploit the issue with a browser.

YaBB 'guestlanguage' Cookie Parameter Local File Include Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

YaBB 'guestlanguage' Cookie Parameter Local File Include Vulnerability

References:

• Attachments security issue (YaBB)
  
• CVE Request: YaBB 2.5.2 and earlier arbitrary code execution (John Lightsey)
  
• Security and file uploads (YaBB)
  
• YaBB Home Page (YaBB)