Ravens PHP Scripts - PHP Upload Center *footerpage* and *language* File Inclusion

SECUNIA ADVISORY ID: SA23204

VERIFY ADVISORY: http://secunia.com/advisories/23204/

CRITICAL: Highly critical

IMPACT: System access

SOFTWARE: PHP Upload Center 2.x - http://secunia.com/product/12792/

DESCRIPTION: GregStar has discovered two vulnerabilities in PHP Upload Center, which can be exploited by malicious people to compromise a vulnerable system. Successful exploitation with other file extensions than ".php" requires that "magic_quotes_gpc" is disabled. The vulnerabilities are confirmed in version 2.0. Other versions may also be affected.

1) Input passed to the "footerpage" parameter in activate.php when "language" is set to "conf" is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

2) Input passed to the "language" parameter in activate.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

SOLUTION: Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY: GregStar

ORIGINAL ADVISORY: http://www.milw0rm.com/exploits/2886