Exponent CMS CVE-2013-3295 Local File Include Vulnerability

Bugtraq ID:	59887
Class:	Input Validation Error
CVE:	CVE-2013-3295
Remote:	Yes
Local:	No
Published:	May 15 2013 12:00AM
Updated:	May 15 2013 12:00AM
Credit:	High-Tech Bridge Security Research Lab
Vulnerable:	Exponent Exponent CMS 2.2.0 beta 3
Not Vulnerable:	Exponent Exponent CMS 2.2.0release-candida

Exponent CMS CVE-2013-3295 Local File Include Vulnerability

Exponent CMS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to view files and execute arbitrary local PHP scripts with the privileges of the affected application.

Exponent CMS 2.2.0 beta 3 is vulnerable; other versions may also be affected.

Exponent CMS CVE-2013-3295 Local File Include Vulnerability

An attacker can exploit the issue with a browser.

The following example URI is available:

http://www.example.com/install/popup.php?page=../../../../etc/passwd%00

Exponent CMS CVE-2013-3295 Local File Include Vulnerability

References:

• Exponent CMS Security Vulnerabilities Notification (Exponent)
  
• ExponentCMS Homepage (ExponentCMS)
  
• Release Candidate 1 - v2.2.0 Set Loose (Exponent)
  
• Multiple Vulnerabilities in Exponent CMS (High-Tech Bridge SA)