User Home Pages (UHP) component for Mambo multiple scripts file include
| userhomepage-multiple-scripts-file-include (28080) |  Medium Risk |
Description:
The User Home Pages (UHP) component for Mambo could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request to multiple scripts using the 'mosConfig_absolute_path' parameter to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable system.
Note: The following scripts are reported to be vulnerable:
footer.php
functions.php
install.uhp.php
toolbar.uhp.html.php
uhp.class.php
uhp_config.php
uninstall.uhp.php
Platforms Affected:
- Mamboserver, UHP component for Mambo 0.5 and prior
Remedy:
Upgrade to the latest version of UHP (0.7 or later), available from the UHP Web site. See References.
Consequences:
Gain Access
References:
- Ravenswood IT Services Web site, Downloads- GPL Components for Joomla/Mambo at http://www.ravenswoodit.co.uk/index.php?option=com_docman&task=cat_view&gid=76&Itemid=13.
- BID-19233: User Home Pages UHP_CONFIG.PHP Remote File Include Vulnerability
- BID-23113: RETIRED: UHP For Mambo UHP_Config.PHP Remote File Include Vulnerability
- CVE-2006-3995: Multiple PHP remote file inclusion vulnerabilities in (1) uhp_config.php, and possibly (2) footer.php, (3) functions.php, (4) install.uhp.php, (5) toolbar.uhp.html.php, (6) uhp.class.php, and (7) uninstall.uhp.php, in the UHP (User Home Pages) 0.5 component (aka com_uhp) for Mambo or Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
- OSVDB ID: 27651: UHP for Mambo uhp_config.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 27652: UHP for Mambo footer.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28111: UHP for Mambo install.uhp.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28112: UHP for Mambo functions.php mosConfig_absolute_path Variable Remote File Inclusion
- OSVDB ID: 28113: UHP for Mambo uninstall.uhp.php mosConfig_absolute_path Variable Remote File Inclusion
- SA21305: Joomla UHP Component File Inclusion Vulnerabilities
- VUPEN/ADV-2006-3056: UHP Component for Mambo and Joomla mosConfig_absolute_path File Inclusion Vulnerability
Reported:
Jul 30, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net