Sonium Enterprise Adressbook Version 0.2 (folder) RFI

vendor:

Sonium Enterprise Adressbook

by:

Philipp Niedziela

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Sonium Enterprise Adressbook

Affected Version From: 0.2

Affected Version To: 0.2

Patch Exists: YES

Related CWE: N/A

CPE: a:sonium-php:sonium_enterprise_adressbook

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Sonium Enterprise Adressbook Version 0.2 (folder) RFI

Sonium Enterprise Adressbook Version 0.2 is vulnerable to Remote File Inclusion due to improper sanitization of the $folder variable. This can lead to Remote File Execution.

Mitigation:

Deny direct access to all files in folder 'plugins' or modify code to check for the presence of the 'folder' variable.

Source

Exploit-DB raw data:

+--------------------------------------------------------------------
+
+ Sonium Enterprise Adressbook Version 0.2 (folder) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: Sonium Enterprise Adressbook Version 0.2
+ Venedor ...........: http://www.sonium-php.de
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Affected Files:
+ /plugins/*.php (not config.php)
+
+ First lines of all these scripts:
+ .....
+     include("$folder/config.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $folder is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Deny direct access to all files in folder "plugins"
+ or modify code:
+
+ if(!isset($_REQUEST['folder']) && !isset($_GET['folder']) &&
!isset($_POST['folder'])){
+  //code of org. *.php
+ }
+ else {
+  echo "You cannot access this file directly.";
+  die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/plugins/1_Adressbuch/delete.php?folder=[script]
+
+--------------------------------------------------------------------
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-18]