exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Weathermap 0.97C Local File Inclusion

Weathermap 0.97C Local File Inclusion
Posted Jun 10, 2013
Authored by Anthony Dubuissez

Weathermap versions 0.97C and below suffer from a local file inclusion vulnerability.

tags | exploit, local, file inclusion
advisories | CVE-2013-3739
SHA-256 | 486331f97939ecbd65c1e512e5b14aec91f638921e861347b680bcb77ee1e12b

Weathermap 0.97C Local File Inclusion

Change Mirror Download
=============================================
WEBERA ALERT ADVISORY 01

- Discovered by: Anthony Dubuissez
- Severity: high
- CVE Request - 03/06/2013
- CVE Assign - 03/06/2013
- CVE Number - CVE-2013-3739
- Vendor notification - 03/06/2013
- Vendor reply - No reply
- Public disclosure - 10/06/2013

=============================================
I. VULNERABILITY -------------------------
Local File Inclusion in Weathermap <= 0.97C

II. BACKGROUND -------------------------

Network Weathermap is a network visualisation tool, to take data you already have and show you an overview of your network in map form. Support is built in for RRD, MRTG (RRD and old log-format), and tab-delimited text files. Other sources are via plugins or external scripts.

III. DESCRIPTION -------------------------
Network Weathermap 0.97C and lower versions contain a flaw that allows a local file inclusion attack. This flaw exists because the application does not properly sanitise the parameter "mapname" in the editor.php file. This allows an attacker to create a specially crafted URL to include any ".config" file on the web server, you can bypass the ".config" restriction filter with a php bug.

the editor.php must be enabled to successfully exploit.
IV. PROOF OF CONCEPT -------------------------
LFI: http://vulnerablesite.com/editor.php?action=show_config&mapname=../../../../../../../../../etc/apache2/apache2.conf

V. BUSINESS IMPACT -------------------------
LFI: With a php bug we can include any file that the webserver has right to read, including sensitive config files ( php file too, because it's not executed but read with fopen) .

VI. SYSTEMS AFFECTED -------------------------
Network Weathermap 0.97C and lower versions

VII. SOLUTION -------------------------
sanitize correctly the mapname parameter.

TEMP SOLUTION : disable editor.php

VIII. REFERENCES -------------------------
http://www.webera.fr/advisory-01-network-weathermap-local-file-inclusion-exploit

IX. CREDITS -------------------------
the vulnerability has been discovered by Anthony Dubuissez (anthony (dot) dubuissez (at) webera (dot) fr).

X. DISCLOSURE TIMELINE -------------------------
June 01, 2013: Vulnerability acquired by Webera
June 03, 2013: Sent to vendor.
June 06, 2013: No reply of vendor, sent second email.
June 10, 2013: No reply of vendor, Advisory published and sent to lists.

XI. LEGAL NOTICES -------------------------
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.Webera accepts no responsibility for any damage caused by the use or misuse of this information.

XII. FOLLOW US -------------------------
You can follow Webera, news and security advisories at:

On twitter : @erathemass

Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close