 phpMyChat Plus Multiple Local File Inclusion VulnerabilitiesDate: Friday, November 10, 2006 @ 20:41:52 CST
Topic: Security
SECUNIA ADVISORY ID: SA22782
VERIFY ADVISORY: http://secunia.com/advisories/22782/
CRITICAL: Moderately critical
IMPACT: Exposure of sensitive information
WHERE: >From remote
SOFTWARE: phpMyChat Plus 1.x - http://secunia.com/product/12556/
DESCRIPTION: ajann has discovered several vulnerabilities in phpMyChat Plus, which can be exploited by malicious people to disclose potentially sensitive information. Input passed to the "ChatPath" parameter in colorhelp_popup.php and color_popup.php and the "L" parameter in avatar.php and logs.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources. Successful exploitation requires that "magic_quotes_gpc" is disabled. Successful exploitation of the colorhelp_popup.php script also requires that "register_globals" is enabled. The vulnerabilities are confirmed in version 1.90_fixed_060917. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly verified.
PROVIDED AND/OR DISCOVERED BY: ajann
|