Txx CMS File Inclusion Vulnerability

vendor:

Txx CMS

by:

nne

N/A

CVSS

N/A

File Inclusion

CWE

Product Name: Txx CMS

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Txx CMS File Inclusion Vulnerability

The Txx CMS has a file inclusion vulnerability in modules/addons/plugin.php, modules/addons/sidebar.php, modules/mail/index.php, and modules/mail/mailbox.php. The variable $doc_root is not defined, which allows an attacker to include arbitrary files. An example exploit URL is http://site.com/modules/addons/plugin.php?doc_root=[vuln]. Additionally, there are numerous XSS vulnerabilities in the CMS.

Mitigation:

The vendor should define the $doc_root variable properly to prevent file inclusion attacks. Additionally, the XSS vulnerabilities should be addressed.

Source

Exploit-DB raw data:

:::::::::::::::::::::::::::::::::::::::::::::::::::.......................
::| \ | (_)          | \ | |                       / ____|                  
::|  \| |_  ___ ___  |  \| | __ _ _ __ ___   ___  | |     _ __ _____      __
::| . ` | |/ __/ _ \ | . ` |/ _` | '_ ` _ \ / _ \ | |    | '__/ _ \ \ /\ / /
::| |\  | | (_|  __/ | |\  | (_| | | | | | |  __/ | |____| | |  __/\ V  V / 
::|_| \_|_|\___\___| |_| \_|\__,_|_| |_| |_|\___|  \_____|_|  \___| \_/\_/
:::::::::::::::::::::::::::::We got the nicest name in the security scene!
::::::::Info::.
::Script: Txx CMS
::Homepage:https://sourceforge.net/projects/txx/
::
:::::::::Details::.
::Type: File_Inclusion
::Dork: "txx cms"
::
::in modules/addons/plugin.php
::and modules/addons/sidebar.php
::and modules/mail/index.php
::and modules/mail/mailbox.php
::
::$doc_root is not defined
::
::http://site.com/modules/addons/plugin.php?doc_root=[vuln]
:: 
::
:: we also found countless xss in there
:: but we wont list em because we got more important 
:: stuff to do  
::::::::::::::::::::::::::::::::.
:::::::::::Additional_Information::.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.
::Contact: nne@chilloutzone.eu
::Website: http://nnc.unkn0wn.eu or http://www.chilloutzone.eu
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::.

# milw0rm.com [2007-09-08]