AOH :: HP Unsorted M :: BT-30040.HTM

Madirish Webmail 2.01 (basedir) RFI/LFI Vulnerability



Madirish Webmail 2.01 (basedir) RFI/LFI Vulnerability
Madirish Webmail 2.01 (basedir) RFI/LFI Vulnerability



Madirish Webmail is prone to Multiple vulnerabilities because it fails to properly sanitize user-supplied input.=0D
=0D
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.=0D
=0D
There is a vulnerability in almost every file directory of Madirish Webmail v2.01.=0D
Vendor fix the vulnerability in version 2.0 and update to v2.0.1=0D
But vendor not perfectly fix the vulnerability , they just edit the code to handle Remote file inclusions,=0D
but as we see still have RFI vulnerability and now i see possible LFI there.=0D
=0D
Attackers can exploit these issues via a browser.=0D
=0D
The following example is available:=0D
=0D
=========================================================================0D
 =0D
	-=[ P0C RFI ]=-=0D
=0D
http://127.0.0.1/Madirish_Webmail/lib/addressbook.php?basedir= [sh3ll inj3ct0r]=0D 
=0D
	-=[ P0C LFI ]=-=0D
=0D
http://127.0.0.1/Madirish_Webmail/index.php?basedir= [LFI]%00=0D 
=0D
	etc, etc, etc=0D
=0D
=========================================================================0D
=0D
Solution: Fix / Edit the code or update to new version if available, Example:=0D
=0D
*/=0D
require_once($basedir."lib/sql.php");	// change into require_once("Madirish_Webmail/lib/sql.php");=0D
require_once($basedir."lib/html.php");	// change into require_once("Madirish_Webmail/lib/html.php");=0D
=0D
=========================| -=[ E0F ]=- |================================

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.