phpAddEdit 1.3 addedit-render.php editform path traversal

Summaryinfo

A vulnerability has been found in phpAddEdit 1.3 and classified as problematic. This impacts an unknown function of the file addedit-render.php. The manipulation of the argument editform leads to path traversal. This vulnerability is uniquely identified as CVE-2008-6313. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as critical, has been found in phpAddEdit 1.3. This issue affects an unknown part of the file addedit-render.php. The manipulation of the argument editform with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Directory traversal vulnerability in addedit-render.php in phpAddEdit 1.3, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a URL in the editform parameter. NOTE: PHP remote file inclusion attacks are also likely.

The weakness was disclosed 02/27/2009 (Website). It is possible to read the advisory at milw0rm.com. The identification of this vulnerability is CVE-2008-6313 since 02/26/2009. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

A public exploit has been developed by nuclear and been published even before and not after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 79 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:addedit-render.php it is possible to find vulnerable targets with Google Hacking.

The vulnerability is also documented in the databases at X-Force (47262), Exploit-DB (7417), SecurityFocus (BID 32774†) and Secunia (SA33027†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• phpAddEdit

Version

• 1.3

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion