| Horde "theme" Local File Inclusion Vulnerability |
|
|
|
| Written by Marcelo Almeida (Vympel) | |||||
| Tuesday, 11 March 2008 | |||||
|
A vulnerability has been reported in various Horde products, which can
be exploited by malicious users to disclose sensitive information and
potentially compromise a vulnerable system. Input passed to the "theme" parameter is not properly sanitised before being used. This can be exploited to include arbitrary files from local resources, using directory traversal attacks and URL-encoded NULL bytes ("%00"). NOTE: Other attack vectors are also reported to exist...
Successful exploitation may allow execution of arbitrary code, but requires valid user credentials.
Powered by a Zone-H(ified) version of AkoComment 3.0! DISCLAIMER: Forum postings are the opinion of the posting author alone, and should not be taken as the opinion of Zone-h. The author is entirely and solely responsible for all content that he/she uploads, posts, or otherwise transmits via the website. Zone-h is not responsible for such content. However, Zone-h shall have the right, but not the obligation, to delete, move, or edit any content that violates this agreement or is otherwise objectionable as determined by Zone-h in its sole discretion and without notice. |
|||||
| < Prev | Next > |
|---|
