e107 search.php search_info Parameter Traversal Arbitrary File Inclusion

high Nessus Plugin ID 18222

Language:

Synopsis

The remote web server contains a PHP script that is affected by a remote file inclusion vulnerability.

Description

The version of e107 installed on the remote host is affected by a remote file inclusion vulnerability because it fails to properly sanitize user-supplied input to the 'search_info' parameter of the 'search.php' script. This vulnerability could allow a remote, unauthenticated attacker to view arbitrary files or execute arbitrary PHP code, possibly taken from third-party hosts, on the remote host.

Note that this requires that the search page is not restricted to members. This setting is found in the 'Security & Protection' menu or the 'Site Preferences' accessed in the admin panel.

Note that the application is also reportedly affected by several additional vulnerabilities including global variable updates, remote file includes, directory traversal, information disclosure, cross-site scripting, and SQL injection; however, Nessus has not tested for these additional issues.

Solution

Upgrade to e107 version 0.7.0 or later.

Plugin Details

Severity: High

ID: 18222

File Name: e107_0617_mult_vulns.nasl

Version: 1.37

Type: remote

Family: CGI abuses

Published: 5/11/2005

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:e107:e107

Required KB Items: www/e107

Exploit Available: true

Exploit Ease: No exploit is required

Exploited by Nessus: true

Patch Publication Date: 1/16/2006

Vulnerability Publication Date: 6/12/2005

Reference Information

BID: 13572

Detections

Analytics