telepark.wiki Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA37391
VERIFY ADVISORY: http://secunia.com/advisories/37391/
DESCRIPTION: Some vulnerabilities have been reported in telepark.wiki, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, disclose sensitive information, and compromise a vulnerable system.
1) Input appended to the URL after index.php/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in the context of an affected site.
2) An error due to improper authentication verification in /ajax/deletePage.php can be exploited to delete pages without any user credentials.
3) An error due to improper authentication verification in /ajax/deleteComment.php can be exploited to delete comments without any user credentials.
4) Input passed via various parameters to multiple scripts is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks.
Examples: http://[host]/getjs.php?css=[code] http://[host]/getcsslocal.php?css=[code] http://[host]/upload.php?group=[code]
5) A vulnerability is caused due to the /ajax/addComment.php script not properly verifying uploaded files. This can be exploited to execute arbitrary PHP code by uploading a PHP file with a specially crafted file name containing a NULL byte.
The vulnerabilities are reported in versions prior to 2.4.25.
SOLUTION: Update to version 2.4.25 or later.
PROVIDED AND/OR DISCOVERED BY: * www.Abysssec.com * The vendor credits Mati Aharoni.
ORIGINAL ADVISORY: http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/ http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt
----------------------------------------------------------------------