Multi SEO phpBB *pfad* File Inclusion Vulnerability

Posted on Thursday, December 04, 2008 @ 15:40:13 PST in Security
by Raven

SECUNIA ADVISORY ID: SA32986

VERIFY ADVISORY: http://secunia.com/advisories/32986/

CRITICAL: Highly critical

IMPACT: System access

SOFTWARE: Multi SEO phpBB 1.x - http://secunia.com/advisories/product/20660/

DESCRIPTION: NoGe has discovered a vulnerability in Multi SEO phpBB, which can be exploited by malicious people to compromise a vulnerable system. This vulnerability is confirmed in version 1.1.0. Other versions may also be affected.

Input passed to the "pfad" parameter in include/global.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local and external resources via URL-encoded NULL bytes.

SOLUTION: Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY: NoGe

ORIGINAL ADVISORY: http://milw0rm.com/exploits/7335
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 359,418,648
  • Today: 102,958
Server InfoServer Info
  • Jun 24, 2018
  • 05:36 pm PDT
 
 

Daily Inspiration