Savant2 Multiple Plugin file include
| savant-multiple-plugin-file-include (27906) |  Medium Risk |
Description:
Savant2 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request to multiple plugin scripts using the 'mosConfig_absolute_path' parameter to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable system.
Affected scripts include:
Savant2_Compiler_basic.php
Savant2_Error_pear.php
Savant2_Error_stack.php
Savant2_Filter_colorizeCode.php
Savant2_Filter_trimwhitespace.php
Savant2_Plugin_ahref.php
Savant2_Plugin_ahrefcontact.php
Savant2_Plugin_ahreflisting.php
Savant2_Plugin_ahreflistingimage.php
Savant2_Plugin_ahrefmap.php
Savant2_Plugin_ahrefownerlisting.php
Savant2_Plugin_ahrefprint.php
Savant2_Plugin_ahrefrating.php
Savant2_Plugin_ahrefrecommend.php
Savant2_Plugin_ahrefreport.php
Savant2_Plugin_ahrefreview.php
Savant2_Plugin_ahrefvisit.php
Savant2_Plugin_checkbox.php
Savant2_Plugin_cycle.php
Savant2_Plugin_dateformat.php
Savant2_Plugin_editor.php
Savant2_Plugin_form.php
Savant2_Plugin_image.php
Savant2_Plugin_input.php
Savant2_Plugin_javascript.php
Savant2_Plugin_listalpha.php
Savant2_Plugin_listingname.php
Savant2_Plugin_modify.php
Savant2_Plugin_mtpath.php
Savant2_Plugin_options.php
Savant2_Plugin_radios.php
Savant2_Plugin_rating.php
Savant2_Plugin_stylesheet.php
Savant2_Plugin_textarea.php
Platforms Affected:
- Paul M. Jones, Savant2
Remedy:
Upgrade to the latest version of Savant2 (1.5.9 or later), available from the Savant2 Web site. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Fri Jul 21 2006 - 11:18:12 CDT , [Kurdish Security # 13] Savant2 Remote File Include Vulnerability [For Mambo, Joomla] at http://archives.neohapsis.com/archives/bugtraq/2006-07/0370.html.
- Savant2 Web site, Savant2 (2.4.3) at http://www.phpsavant.com/yawiki/.
- BID-19151: PHPSavant Savant2 Multiple Remote File Include Vulnerabilities
- CVE-2006-3990: Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) Savant2_Plugin_stylesheet.php, (2) Savant2_Compiler_basic.php, (3) Savant2_Error_pear.php, (4) Savant2_Error_stack.php, (5) Savant2_Filter_colorizeCode.php, (6) Savant2_Filter_trimwhitespace.php, (7) Savant2_Plugin_ahref.php, (8) Savant2_Plugin_ahrefcontact.php, (9) Savant2_Plugin_ahreflisting.php, (10) Savant2_Plugin_ahreflistingimage.php, (11) Savant2_Plugin_ahrefmap.php, (12) Savant2_Plugin_ahrefownerlisting.php, (13) Savant2_Plugin_ahrefprint.php, (14) Savant2_Plugin_ahrefrating.php, (15) Savant2_Plugin_ahrefrecommend.php, (16) Sav
- OSVDB ID: 28679: Mosets Tree Savant2_Compiler_basic.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28680: Mosets Tree Savant2_Error_pear.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28681: Mosets Tree Savant2_Error_stack.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28682: Mosets Tree Savant2_Filter_colorizeCode.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28683: Mosets Tree Savant2_Filter_trimwhitespace.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28684: Mosets Tree Savant2_Plugin_ahref.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28685: Mosets Tree Savant2_Plugin_ahrefcontact.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28686: Mosets Tree Savant2_Plugin_ahreflisting.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28687: Mosets Tree Savant2_Plugin_ahreflistingimage.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28688: Mosets Tree Savant2_Plugin_ahrefmap.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28689: Mosets Tree Savant2_Plugin_ahrefownerlisting.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28690: Mosets Tree Savant2_Plugin_ahrefprint.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28691: Mosets Tree Savant2_Plugin_ahrefrating.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28692: Mosets Tree Savant2_Plugin_ahrefrecommend.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28693: Mosets Tree Savant2_Plugin_ahrefreport.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28694: Mosets Tree Savant2_Plugin_ahrefreview.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28695: Mosets Tree Savant2_Plugin_ahrefvisit.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28696: Mosets Tree Savant2_Plugin_checkbox.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28697: Mosets Tree Savant2_Plugin_cycle.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28698: Mosets Tree Savant2_Plugin_dateformat.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28699: Mosets Tree Savant2_Plugin_editor.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28700: Mosets Tree Savant2_Plugin_form.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28701: Mosets Tree Savant2_Plugin_image.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28702: Mosets Tree Savant2_Plugin_input.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28703: Mosets Tree Savant2_Plugin_javascript.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28704: Mosets Tree Savant2_Plugin_listalpha.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28705: Mosets Tree Savant2_Plugin_listingname.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28706: Mosets Tree Savant2_Plugin_modify.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28707: Mosets Tree Savant2_Plugin_mtpath.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28708: Mosets Tree Savant2_Plugin_options.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28709: Mosets Tree Savant2_Plugin_radios.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28710: Mosets Tree Savant2_Plugin_rating.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28711: Mosets Tree Savant2_Plugin_stylesheet.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28712: Mosets Tree Savant2_Plugin_textarea.php mosConfig_absolute_path Variable Remote File Inclusion
- SECTRACK ID: 1016560: Savant2 Include File Bug Lets Remote Users Execute Arbitrary Code
Reported:
Jul 21, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net