A.l-Pifou livre_lire.php ze_langue_02 Cookie Variable Local File Inclusion

2006-09-20T12:18:51
ID OSVDB:29014
Type osvdb
Reporter cdg393()
Modified 2006-09-20T12:18:51

Description

Vulnerability Description

A.l-Pifou contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to livre_lire.php not properly sanitizing user input supplied to the 'e_langue_02' cookie variable. This may allow an attacker to include a file from a local host that contains arbitrary commands which will be executed by the vulnerable script.

Technical Description

This vulnerability is only present when the magic_quotes_gpc PHP option is 'off'.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

A.l-Pifou contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to livre_lire.php not properly sanitizing user input supplied to the 'e_langue_02' cookie variable. This may allow an attacker to include a file from a local host that contains arbitrary commands which will be executed by the vulnerable script.

References:

Vendor URL: http://actif-video.chez-alice.fr/index.php Secunia Advisory ID:22038 Mail List Post: http://seclists.org/fulldisclosure/2006/Sep/0341.html CVE-2006-4914