phpMyWebmin File Inclusions and Information Disclosure
Secunia Advisory: SA22178
Release Date: 2006-09-29
Last Update: 2006-10-13
Popularity: 4,050 views

Critical:
Highly critical
Impact: Exposure of system information
System access
Where: From remote
Solution Status: Unpatched

Software:phpMyWebmin 1.x

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference:CVE-2006-5124
CVE-2006-5125
CVE-2006-5181


Description:
Some vulnerabilities and two weaknesses have been discovered in phpMyWebmin, which can be exploited by malicious people to disclose system information and compromise a vulnerable system.

1) Input passed to the "target" parameter in window.php and home.php isn't properly verified, before it is used in an "opendir()" call. This can be exploited to list files in arbitrary directories.

2) Input passed to the "target" and "action" parameters in window.php, and to the "target" parameter in change_preferences2.php, create_file.php, upload_local.php, and upload_multi.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

The vulnerabilities and the weaknesses have been confirmed in version 1.0. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly verified.

Provided and/or discovered by:
1) Kernel-32
2) Kernel-32 and XORON.

Changelog:
2006-10-03: Added additional vulnerabilities in change_preferences2.php, create_file.php, upload_local.php, and upload_multi.php reported by XORON.
2006-10-12: Added CVE reference.

Original Advisory:
http://milw0rm.com/exploits/2451


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Today
New advisories: 9
New vulnerabilities: 12
Updated advisories: 16

Moderately // 260 views
rPath update for libtiff
Highly // 254 views
Gentoo update for realplayer
Less // 253 views
Gentoo update for mysql
Moderately // 249 views
Gentoo update for dnsmasq
Highly // 260 views
Gentoo update for yelp

4th Sep, 2008
New advisories: 19
New vulnerabilities: 41
Updated advisories: 35


Solutions | More...  


Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. 3Com Wireless 8760 Access Point HTTP Request Processing Denial of Service // 109 views
2. HP OpenView Select Identity Connectors Information Disclosure // 71 views
3. Drupal Content Construction Kit Script Insertion Vulnerabilities // 69 views
4. Cisco ASA and PIX Security Appliances Multiple Vulnerabilities // 62 views
5. Gentoo update for yelp // 49 views
6. rPath update for libtiff // 48 views
7. CS-Cart "cs_cookies" SQL Injection Vulnerability // 48 views
8. Gentoo update for dnsmasq // 47 views
9. Gentoo update for mysql // 47 views
10. Cisco Secure ACS EAP Packet Denial of Service // 46 views