Info

Disclosure

May 21, 2006

Discovery

Unknown

Dates

Exploit

May 21, 2006

Solution

Unknown

Description

Xoops contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when passing input to "xoopsConfig" array parameter when the "xoopsOption[nocommon]" parameter is defined, which will disclose arbitrary files from local resources resulting in a loss of confidentiality.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public
OSVDB: Web Related

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Xoops has released a patch to address this vulnerability.

Products

Xoops

2.0.13.2

References

Bugtraq ID: 18061
Milw0rm: 1811
Exploit Database: 1811
CVE ID: 2006-2516 (see also: NVD)
Secunia Advisory ID: 20176
VUPEN Advisory: ADV-2006-1895
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-05/0416.html
Vendor Specific Solution URL: http://www.xoops.org/modules/news/article.php?storyid=3112

Credit

rgod - rgodautistici.org - http://retrogod.altervista.org

Direct URL: http://osvdb.org/25683