Virtual War multiple scripts vwar_root parameter file include
| virtual-war-multiple-file-include (25497) |  Medium Risk |
Description:
Virtual War (VWar) could allow a remote attacker to include malicious PHP files. If register_globals is enabled, a remote attacker could send a specially-crafted URL request to multiple scripts using the vwar_root parameter to specify a malicious PHP file from a remote system, which would allow the attacker to execute arbitrary code on the vulnerable system.
Platforms Affected:
- vwar.biz, Virtual War 1.5.0 R11
Remedy:
No remedy available as of December 2008.
Consequences:
Gain Access
References:
- Bugtraq Mailing List, Sat Apr 08 2006 - 08:27:58 CDT , Virtual War File Inclusion at http://archives.neohapsis.com/archives/bugtraq/2006-04/0161.html.
- Bugtraq Mailing List, Tue Mar 28 2006 - 01:00:16 CST , VWar <= 1.5.0 R11 Remote Code Execution Exploit at http://archives.neohapsis.com/archives/bugtraq/2006-03/0528.html.
- Virtual War Web site, VWar - Virtual War at http://www.vwar.de/.
- BID-17290: VWar Functions_install.PHP Remote File Include Vulnerability
- BID-17315: VWar Functions_Admin.PHP Remote File Include Vulnerability
- BID-17443: VWar Admin.PHP Remote File Include Vulnerability
- BID-19387: VWar Multiple Remote File Include Vulnerabilities
- CVE-2005-4748: PHP remote file include vulnerability in functions_admin.php in Virtual War (VWar) 1.5.0 R10 allows remote attackers to include and execute arbitrary PHP code via unspecified attack vectors. NOTE: this issue has been referred to as XSS, but it is clear from the vendor description that it is a file inclusion problem.
- CVE-2006-1503: PHP remote file inclusion vulnerability in includes/functions_install.php in Virtual War (VWar) 1.5.0 R11 and earlier allows remote attackers to include and execute arbitrary PHP code via a URL in the vwar_root parameter. NOTE: this is a different vulnerability than CVE-2006-1636.
- CVE-2006-1747: PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter to (1) admin/admin.php, (2) war.php, (3) stats.php, (4) news.php, (5) joinus.php, (6) challenge.php, (7) calendar.php, (8) member.php, (9) popup.php, and other unspecified scripts in the admin folder. NOTE: these are different attack vectors than CVE-2006-1636 and CVE-2006-1503.
- OSVDB ID: 24239: Virtual War (Vwar) includes/functions_install.php vwar_root Variable Remote File Inclusion
- SA19438: Virtual War "vwar_root" File Inclusion Vulnerability
- VUPEN/ADV-2006-1144: Virtual War vwar_root Variable Handling Remote File Inclusion Vulnerability
Reported:
Mar 29, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net