exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Weathermap 0.97C Local File Inclusion

Weathermap 0.97C Local File Inclusion
Posted Jun 10, 2013
Authored by Anthony Dubuissez

Weathermap versions 0.97C and below suffer from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
advisories | CVE-2013-3739
SHA-256 | 486331f97939ecbd65c1e512e5b14aec91f638921e861347b680bcb77ee1e12b

Weathermap 0.97C Local File Inclusion

Change Mirror Download
=============================================
WEBERA ALERT ADVISORY 01

- Discovered by: Anthony Dubuissez
- Severity: high
- CVE Request - 03/06/2013
- CVE Assign - 03/06/2013
- CVE Number - CVE-2013-3739
- Vendor notification - 03/06/2013
- Vendor reply - No reply
- Public disclosure - 10/06/2013

=============================================
I. VULNERABILITY -------------------------
Local File Inclusion in Weathermap <= 0.97C

II. BACKGROUND -------------------------

Network Weathermap is a network visualisation tool, to take data you already have and show you an overview of your network in map form. Support is built in for RRD, MRTG (RRD and old log-format), and tab-delimited text files. Other sources are via plugins or external scripts.

III. DESCRIPTION -------------------------
Network Weathermap 0.97C and lower versions contain a flaw that allows a local file inclusion attack. This flaw exists because the application does not properly sanitise the parameter "mapname" in the editor.php file. This allows an attacker to create a specially crafted URL to include any ".config" file on the web server, you can bypass the ".config" restriction filter with a php bug.

the editor.php must be enabled to successfully exploit.
IV. PROOF OF CONCEPT -------------------------
LFI: http://vulnerablesite.com/editor.php?action=show_config&mapname=../../../../../../../../../etc/apache2/apache2.conf

V. BUSINESS IMPACT -------------------------
LFI: With a php bug we can include any file that the webserver has right to read, including sensitive config files ( php file too, because it's not executed but read with fopen) .

VI. SYSTEMS AFFECTED -------------------------
Network Weathermap 0.97C and lower versions

VII. SOLUTION -------------------------
sanitize correctly the mapname parameter.

TEMP SOLUTION : disable editor.php

VIII. REFERENCES -------------------------
http://www.webera.fr/advisory-01-network-weathermap-local-file-inclusion-exploit

IX. CREDITS -------------------------
the vulnerability has been discovered by Anthony Dubuissez (anthony (dot) dubuissez (at) webera (dot) fr).

X. DISCLOSURE TIMELINE -------------------------
June 01, 2013: Vulnerability acquired by Webera
June 03, 2013: Sent to vendor.
June 06, 2013: No reply of vendor, sent second email.
June 10, 2013: No reply of vendor, Advisory published and sent to lists.

XI. LEGAL NOTICES -------------------------
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.Webera accepts no responsibility for any damage caused by the use or misuse of this information.

XII. FOLLOW US -------------------------
You can follow Webera, news and security advisories at:

On twitter : @erathemass

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close