[ABANDONED] Sitemap 2.0.0 for Mambo 4.5.1 Remote File Include Vulnerabilities

[RobS]

Author : Matdhule
Contact : [email protected]
Application : Sitemap 2.0.0 for Mambo 4.5.1 CMS
Version : Sitemap 2.0.0
Download : http://mamboxchange.com/frs/download.ph ... emap20.zip

Have a nice day
Gustavo

[Peter Koch]

Apperently also joommap 2.05 has this construct (vulnerability yet unconfirmed)

No, everything seems clean in joommap 2.0.5.

I can however confirm the issue with sitemap 2.0.0

[gustavo]

and two days after, the official report on secutiry related sites..

Advisory ID : FrSIRT/ADV-2006-2803
CVE ID : GENERIC-MAP-NOMATCH
Rated as : High Risk
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2006-07-14

Technical Description

A vulnerability has been identified in SiteMap (component for Mambo), which may be exploited by attackers to execute arbitrary commands. This flaw is due to an input validation error in the "sitemap.xml.php" script that fails to validate the "mosConfig_absolute_path" parameter, which could be exploited by remote attackers to include malicious files and execute arbitrary commands with the privileges of the web server.

Affected Products

SiteMap (component for Mambo) version 2.0 and prior

http://www.frsirt.com/english/advisories/2006/2803

Have a nice day
Gustavo

[Jinx]

The sitemap 2.0 component is not actively maintained and should not be used on any production websites ! The component has been removed from mamboforge.