openEngine website.php file include
| openengine-website-file-include (26345) |  Medium Risk |
Description:
openEngine could allow a remote attacker to traverse directories and include local files on the system. A remote attacker could send a specially-crafted URL request to the website.php script using the 'template' parameter to include or view any known file on the system and possibly obtain other sensitive information.
Consequences:
Gain Access
Remedy:
No remedy available as of February 6, 2010.
References:
- Bugtraq Mailing List, Sun May 07 2006 - 08:36:31 CDT : OpenEngine (PHP CMS).
- openEngine Web Content Management System Web site: openEngine Web Content Management System.
- BID-17871: OpenEngine Template Unauthorized Access Vulnerability
- CVE-2006-2280: Directory traversal vulnerability in website.php in openEngine 1.8 Beta 2 and earlier allows remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the template parameter.
- OSVDB ID: 25359: openEngine website.php template Variable Local File Inclusion
- SA20047: openEngine "template" Parameter Local File Inclusion Vulnerability
- VUPEN/ADV-2006-1728: openEngine template Parameter Handling Local File Inclusion Vulnerability
Platforms Affected:
- openEngine openEngine 1.7.1
- openEngine openEngine 1.8 beta2
Reported:
May 07, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net