PluXml 5.1.5 local File Inclusion Defects and repair

Developer Website: pluxml.org
Affected Versions: 5.1.5 and earlier
Tested version: 5.1.5
Patch time: 16 10000l 2012
Problem type: local file inclusion
Repair status: author corrected
High risk

Logs
 
High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File compression sion attacks.
 
 
1) Local File transfer sion in PluXml
 
1.1 Input passed via the "default_lang" POST parameter to/update/index. php is not properly verified before being used in www.2cto.com include_once () function and can be exploited to include arbitrary local files.
This can be exploited to include local files via directory traversal sequences and URL-encoded NULL bytes.
 
The following PoC (Proof Concept) demonstrates the vulnerability:
 
 
POST/update/index. php HTTP/1.1
[...]
Content-Type: application/x-www-form-urlencoded
Content-Length: [...]
 
Default_lang =... % 2F... % 2F... % 2F... % 2F... % 2F... % 2F... % 2F... % 2 Fetc % 2 Fpasswd % 00
 
 
Bytes -----------------------------------------------------------------------------------------------
 
Solution:
 
Upgrade to PluXml 5.1.6
 
More Information:
Http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6
Http://telechargements.pluxml.org/changelog
 
Bytes -----------------------------------------------------------------------------------------------