SNS Vulnerability

FSphp "FSPHP_LIB" Parameter Remote File Inclusion Vulnerabilities

Description

Multiple vulnerabilities have been identified in FSphp, which could be exploited by attackers to execute arbitrary commands. These issues are caused by input validation errors in the "lib/FSphp.php", "lib/navigation.php" and "lib/pathwirte.php" scripts when processing the "FSPHP_LIB" parameter, which could be exploited by remote attackers to include malicious scripts and execute arbitrary commands with the privileges of the web server.

Vulnerable Products

Vulnerable Software:
FSphp version 0.2.1 and prior

Solution

CVE

CVE-2009-3307

References

http://milw0rm.com/exploits/9720

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
Misc : Directory traversal - parameter starting with ../	3.2.0
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL	3.2.0
Directory traversal using ..\..	3.2.0
Directory traversal	3.2.0
PHP : Remote file inclusion prevention : URL found as parameter	3.2.0
Directory traversal backward root folder	3.2.0

Risk level

High

Vulnerability First Public Report Date

2009-09-21

Target Type

Server

Possible exploit

Local & Remote