X2CRM 'file' Parameter Local File Include Vulnerability

Bugtraq ID:	62633
Class:	Input Validation Error
CVE:	CVE-2013-5692
Remote:	Yes
Local:	No
Published:	Sep 25 2013 12:00AM
Updated:	Sep 25 2013 12:00AM
Credit:	High-Tech Bridge Security Research Lab
Vulnerable:
Not Vulnerable:

X2CRM 'file' Parameter Local File Include Vulnerability

X2CRM is prone to a local file include vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

X2CRM 3.4.1 is vulnerable; other versions may also be affected.

X2CRM 'file' Parameter Local File Include Vulnerability

An attacker can exploit this issue using a web browser.

The following example URIs are available:

http://www.example.com/index.php/admin/translationManager?file=../../../../../etc/passwd

http://www.example.com/index.php/admin/translationManager?file=../../../../../tmp/file.php

X2CRM 'file' Parameter Local File Include Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

X2CRM 'file' Parameter Local File Include Vulnerability

References:

• Multiple Vulnerabilities in X2CRM (High-Tech Bridge SA)
  
• X2CRM 3.5 Released (X2Engine)
  
• X2CRM Homepage (X2Engine)