PHP Live Helper "abs_path" parameter file include
| phplivehelper-abspath-file-include (25489) |  Medium Risk |
Description:
PHP Live Helper could allow a remote attacker to include malicious PHP files. A remote attacker could send a specially-crafted URL request to multiple scripts using the 'abs_path' parameter to specify a malicious PHP file from the local or a remote system, which would allow the attacker to execute arbitrary code on the vulnerable system.
Platforms Affected:
- Turnkey Web Tools, PHP Live Helper 1.8
Remedy:
Upgrade to the latest version of PHP Live Helper (1.8.1 or later), available from the PHP Live Helper Web site. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Mon Jun 19 2006 - 12:05:11 CDT, Re: PHP Live Helper <=([abs_path]) Remote File Include Vulnerabilities at http://archives.neohapsis.com/archives/bugtraq/2006-06/0416.html.
- BugTraq Mailing List, Mon Mar 27 2006 - 16:20:51 CST, PHPLiveHelper 1.8 remote command execution (include) Xploit (perl) at http://archives.neohapsis.com/archives/bugtraq/2006-03/0522.html.
- BugTraq Mailing List, Sun Jun 18 2006 - 20:53:59 CDT, PHP Live Helper <=([abs_path]) Remote File Include Vulnerabilities at http://archives.neohapsis.com/archives/bugtraq/2006-06/0408.html.
- TURNkeyWEBtools Web site, PHP Live Helper Overview at http://www.turnkeywebtools.com/index.php/location/products/product/phplivehelper/sub/overview/.
- BID-18509: PHP Live Helper Initiate.PHP Remote File Include Vulnerability
- CVE-2006-1477: Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary PHP code via the abs_path parameter in (1) initiate.php, (2) waiting.php, (3) welcome.php, (4) admin/index.php, (5) javascript.php, (6) checkchat.php, and (7) blank.php.
- CVE-2006-1478: Directory traversal vulnerability in (1) initiate.php and (2) possibly other PHP scripts in Turnkey Web Tools PHP Live Helper 1.8, and possibly later versions, allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the language cookie, as demonstrated by uploading PHP code in a gl_session cookie to users.php, which causes the code to be stored in error.log, which is then included by initiate.php.
- OSVDB ID: 24193: PHP Live Helper initiate.php abs_path Variable Remote File Inclusion
- OSVDB ID: 24194: PHP Live Helper waiting.php abs_path Variable Remote File Inclusion
- OSVDB ID: 24195: PHP Live Helper welcome.php abs_path Variable Remote File Inclusion
- OSVDB ID: 24196: PHP Live Helper admin/index.php abs_path Variable Remote File Inclusion
- OSVDB ID: 24197: PHP Live Helper javascript.php abs_path Variable Remote File Inclusion
- OSVDB ID: 24198: PHP Live Helper checkchat.php abs_path Variable Remote File Inclusion
- OSVDB ID: 24199: PHP Live Helper blank.php abs_path Variable Remote File Inclusion
- SA19428: PHP Live Helper "abs_path" File Inclusion Vulnerability
- VUPEN/ADV-2006-1137: PHP Live Helper abs_path Parameter Remote File Inclusion Vulnerabilities
Reported:
Mar 27, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net