Description
Multiple PHP file inclusion vulnerabilities in MySource 2.14.0 allow remote attackers to execute arbitrary PHP code and include arbitrary local files via the (1) INCLUDE_PATH and (2) SQUIZLIB_PATH parameters in new_upgrade_functions.php, (3) the INCLUDE_PATH parameter in init_mysource.php, and the PEAR_PATH parameter in (4) Socket.php, (5) Request.php, (6) Mail.php, (7) Date.php, (8) Span.php, (9) mimeDecode.php, and (10) mime.php.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 9
- MySource 2.14 - 'new_upgrade_functions.php' Multiple Remote File Inclusions EDB-26362 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'init_mysource.php?INCLUDE_PATH' Remote File Inclusion EDB-26363 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'Socket.php?PEAR_PATH' Remote File Inclusion EDB-26364 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'Request.php?PEAR_PATH' Remote File Inclusion EDB-26365 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'mail.php?PEAR_PATH' Remote File Inclusion EDB-26369 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'Date.php?PEAR_PATH' Remote File Inclusion EDB-26370 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'Span.php?PEAR_PATH' Remote File Inclusion EDB-26371 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'mimeDecode.php?PEAR_PATH' Remote File Inclusion EDB-26372 · webapps · Oct 18, 2005 · verified
- MySource 2.14 - 'mime.php?PEAR_PATH' Remote File Inclusion EDB-26373 · webapps · Oct 18, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 92 third-party-advisory
- 20039 vdb-entry
- 20037 vdb-entry
- 20051018 Secunia Research: MySource Cross-Site Scripting and File Inclusion mailing-list
- 20036 vdb-entry
- mysource-multiple-file-include(22772) vdb-entry
- 16946 third-party-advisory
- 20040 vdb-entry
- ADV-2005-2132 vdb-entry
- 15133 vdb-entry
- 1015075 vdb-entry
- 20038 vdb-entry
- 20041 vdb-entry
- 20035 vdb-entry
- 20042 vdb-entry
- 20043 vdb-entry