Description
Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 4
- LinPHA 0.9.x/1.0 - 'lang' Local File Inclusion EDB-27192 · webapps · Feb 11, 2006 · verified
- LinPHA 0.9.x/1.0 - 'install.php' Local File Inclusion EDB-27193 · webapps · Feb 11, 2006 · verified
- LinPHA 0.9.x/1.0 - 'sec_stage_install.php' Local File Inclusion EDB-27194 · webapps · Feb 11, 2006 · verified
- LinPHA 0.9.x/1.0 - 'forth_stage_install.php' Local File Inclusion EDB-27195 · webapps · Feb 11, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060211 Linpha <= 1.0 multiple arbitrary local inclusion mailing-list
- 18808 third-party-advisory
- linpha-index-file-include(24663) vdb-entry
- 16592 vdb-entry
- 426 third-party-advisory
- http://retrogod.altervista.org/linpha_10_local.html
- ADV-2006-0535 vdb-entry