PHP-Proxima autohtml.PHP Information Disclosure Vulnerability

Bugtraq ID:	7598
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2003 12:00AM
Updated:	May 14 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to "Mind Warper" <[email protected]>.
Vulnerable:	PHP-Proxima PHP-Proxima
Not Vulnerable:

PHP-Proxima autohtml.PHP Information Disclosure Vulnerability

A vulnerability has been reported for PHP-Proxima. The problem occurs in the autohtml.php script. Specifically, the script fails to verify the contents of a user-supplied variable before including a specified file into an HTML file. As a result, a malicious remote user may be capable of using this as a channel to disclose the contents of arbitrary local system files.

It should be noted that all local files would be accessed with the privileges of user invoking PHP-Proxima.

PHP-Proxima autohtml.PHP Information Disclosure Vulnerability

The following proof of concept URL has been provided:

http://www.target.org/autohtml.php?op=modload&mainfile=x&name=filename

PHP-Proxima autohtml.PHP Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP-Proxima autohtml.PHP Information Disclosure Vulnerability

References:

• php-proxima Remote File Access Vulnerability ("Mind Warper" )