NOCC index.php file include
| nocc-index-file-include (24934) |  Medium Risk |
Description:
NOCC could allow a remote attacker to include malicious PHP files. A remote attacker could send a specially-crafted URL request to the index.php script using the lang and theme parameters or the Accept-Language HTTP header to specify a malicious PHP file from the local system, which would allow the attacker to execute arbitrary code on the vulnerable system.
Consequences:
Gain Access
Remedy:
No remedy available as of July 9, 2011.
References:
- Bugtraq Mailing List, Thu Feb 23 2006 - 04:40:55 CST : NOCC Webmail <= 1.0 multiple vulnerabilities.
- NOCC Web site: NOCC Webmail.
- BID-16793: NOCC Webmail Multiple Input Validation Vulnerabilities
- CVE-2006-0891: Multiple directory traversal vulnerabilities in NOCC Webmail 1.0 allow remote attackers to include arbitrary files via .. (dot dot) sequences and a trailing NULL (%00) byte in (1) the _SESSION['nocc_theme'] parameter in (a) html/footer.php; and (2) the lang and (3) theme parameters and the (4) Accept-Language HTTP header field, when force_default_lang is disabled, in (b) index.php, as demonstrated by injecting PHP code into a profile and accessing it using the lang parameter in index.php.
- CVE-2006-0892: NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames, which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.
- OSVDB ID: 23416: NOCC footer.php nocc_theme Variable Traversal Arbitrary File Access
- OSVDB ID: 23417: NOCC common.php lang Variable Traversal Arbitrary File Access
- OSVDB ID: 23418: NOCC functions.php Accept-Language HTTP Field Local PHP File Inclusion
- OSVDB ID: 23419: NOCC index.php theme Variable Traversal Arbitrary File Access
- OSVDB ID: 23420: NOCC Mail Attachment Predictable Temp File Name Arbitrary Command Execution
- SA16921: NOCC Multiple Vulnerabilities and Security Issue
- SECTRACK ID: 1015671: NOCC Has Multiple Bugs That Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks
Platforms Affected:
- NOCC Development Team NOCC 1.0
Reported:
Feb 23, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net