Middlebury College Segue CMS up to 1.5.9 themesettings.php theme file inclusion

Summaryinfo

A vulnerability was found in Middlebury College Segue CMS up to 1.5.9. It has been declared as critical. The affected element is an unknown function of the file themesettings.php. Such manipulation of the argument theme leads to file inclusion. This vulnerability is documented as CVE-2006-5722. There is not any exploit available.

Detailsinfo

A vulnerability was found in Middlebury College Segue CMS up to 1.5.9 (Content Management System) and classified as critical. Affected by this issue is some unknown processing of the file themesettings.php. The manipulation of the argument theme with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Multiple PHP remote file inclusion vulnerabilities in Segue CMS 1.5.9 and earlier, when magic_quotes_gpc is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the theme parameter to (1) themesettings.php or (2) index.php, a different vector than CVE-2006-5497. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The weakness was released 11/03/2006 (Website). The advisory is shared for download at vupen.com. This vulnerability is handled as CVE-2006-5722 since 11/03/2006. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

It is declared as proof-of-concept. By approaching the search of inurl:themesettings.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Secunia (SA22582†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Middlebury College

Name

• Segue CMS

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion