Download-Engine spaw_root file include
| downloadengine-spaw-file-include (29493) |  Medium Risk |
Description:
Download-Engine could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request to multiple scripts using the spaw_root, spaw_dir, spaw_base_url or the _ENGINE[eng_dir] parameter to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server.
Platforms Affected:
- alexscriptengine, Download-Engine 1.4.2 and prior
Remedy:
Upgrade to the latest version of Download-Engine (1.4.3 or later), available from the ScriptEngine.de Web site. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Thu Oct 12 2006 - 18:18:22 CDT, Download-Engine Remote File İnclude at http://archives.neohapsis.com/archives/bugtraq/2006-10/0200.html.
- ScriptEngine.de Web site, PHP and MySQL Solutions at http://www.alexscriptengine.de/v2/index.php.
- BID-20500: Alex DownloadEngine Spaw_Root Remote File Include Vulnerability
- CVE-2006-5291: PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition, so this issue is probably a duplicate of CVE-2006-4656.
- CVE-2006-5459: Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) $_ENGINE[eng_dir] and possibly (2) spaw_root parameters in admin/includes/spaw/spaw_script.js.php, and the (3) $_ENGINE[eng_dir], (4) $spaw_root, (5) $spaw_dir, and (6) $spaw_base_url parameters in admin/includes/spaw/config/spaw_control.config.php, different vectors than CVE-2006-5291. NOTE: CVE analysis as of 20061021 is inconclusive, but suggests that some or all of the suggested attack vectors are ineffective.
- SA22383: Download-Engine "spaw_root" File Inclusion Vulnerability
- VUPEN/ADV-2006-4025: Download-Engine spaw_root Parameter Handling PHP File Inclusion Vulnerability
Reported:
Oct 12, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net