OSVDB ID: 57100

Title: MAXcms classes/class.Tree.php GLOBALS[thCMS_root] Parameter Remote File Inclusion

Info

Disclosure

Aug 01, 2009

Discovery

Unknown

Dates

Exploit

Aug 01, 2009

Solution

Unknown

Description

MAXcms contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to the 'classes/class.Tree.php' script not properly sanitizing user input supplied to the 'GLOBALS[thCMS_root]' parameter. This may allow an attacker to include a file from an arbitrary remote host that contains commands which will be executed by the vulnerable script with the same privileges as the web server.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified, Third-party Verified, Uncoordinated Disclosure
OSVDB: Web Related

Solution

Upgrade to version 3.16.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Databay AG

MAXcms

3.11.20b

References

CVE ID: 2009-3424 (see also: NVD)
Secunia Advisory ID: 36105
Related OSVDB ID: 57068 57069 57070 57071 57072 57073 57074 57075 57076 57077 57078 57079 57080 57081 57082 57083 57084 57085 57086 57087 57088 57089 57090 57091 57092 57093 57094 57095 57096 57097 57098 57099 57101
Milw0rm: 9322
Exploit Database: 9322
Vendor URL: http://www.databay.de
Other Advisory URL: http://www.vupen.com/english/advisories/2009/2136

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/57100