Aardvark Topsites PHP Multiple Vulnerabilities

Bugtraq ID:	9231
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2003 12:00AM
Updated:	Dec 16 2003 12:00AM
Credit:	The disclosure of these issues has been credited to JeiAr of the GulfTech Security Research Team <http://www.gulftech.org>.
Vulnerable:	Aardvark Topsites PHP Aardvark Topsites PHP 4.1
Not Vulnerable:	Aardvark Topsites PHP Aardvark Topsites PHP 4.1.1

Aardvark Topsites PHP Multiple Vulnerabilities

Multiple vulnerabilities have been identified in the software that include information disclosure, path disclosure, SQL injection, and a plaintext password weakness.

Aardvark Topsites PHP version 4.1.0 has been reported to be prone to these issue, however other versions may be affected as well.

Aardvark Topsites PHP Multiple Vulnerabilities

The following proof of concept examples have been provided for the SQL injection issue:

http://www.example.com/index.php?method=`
http://www.example.com/index.php?a=lostpw&set=1&id=`
http://www.example.com/index.php?a=lostpw&set=1&session_id=`

Aardvark Topsites PHP Multiple Vulnerabilities

Solution:
The vendor has released Aardvark Topsites PHP version 4.1.1 to address these issues.


Aardvark Topsites PHP Aardvark Topsites PHP 4.1

• Aardvark Topsites PHP topsitesphp-4.1.1.zip
  http://www.aardvarkind.com/topsitesphp/topsitesphp-4.1.1.zip

Aardvark Topsites PHP Multiple Vulnerabilities

References:

• Aardvark Topsites PHP Homepage (Aardvark Topsites PHP)
  
• Aardvark Topsites 4.1.0 Vulnerabilities (JeiAr )