Cedric Email Reader Global Configuration Script Remote File Include Vulnerability
BID:6820
Info
Cedric Email Reader Global Configuration Script Remote File Include Vulnerability
| Bugtraq ID: | 6820 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 09 2003 12:00AM |
| Updated: | Feb 09 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to: MGhz <[email protected]> |
| Vulnerable: |
ISOCA Cedric email reader 0.4 |
| Not Vulnerable: | |
Discussion
Cedric Email Reader Global Configuration Script Remote File Include Vulnerability
It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreader_execute_on_each_page.inc.php' script.
Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.
If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.
It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed.
It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreader_execute_on_each_page.inc.php' script.
Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.
If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.
It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed.