http://bichosoft.webcindario.com/advisory-01.txt


VULNERABILITIES IN ARTMEDIC HPMAKER FILE INCLUSION VULNERABILITY


Affected software description:
-------------------------------

 artmedic homepagemaker
 autor: artmedic webdesign
 web: http://www.artmedic-webdesign.de/hp-maker/

Vulnerabilities:
-----------------

The vulnerable of code is in the index.php script


     -----------------------------------------------------------
           <?php 		  
	       if(!isset($_GET['p'])) {include("start.htm");}
	       else
	       {include("$_GET[p]");}
            ?>
     -----------------------------------------------------------


Details :
-------

If the remote file is a malicious PHP script, this may allow for the execution 
of attacker-supplied PHP code with the privileges of the web server. Successful 
exploitation may provide unauthorized remote access to the attacker. This issue 
may also be exploited to remotely view files on the vulnerable host.



Example:
-----------
 An example of an HTTP request that can exploit this vulnerability is:

     http://[victim_host]/index.php?p=../../../../../../../../etc/passwd


Greetings:
----------

Greetings to the people of of peru specially a security wary proyects
http://www.swp-zone.org and a http://www.perunderforce.tk

Contact:
-------
 DarkBicho
 darkbicho@msn.com
 Homepage: http://www.darkbicho.tk




---------------------------------- [ EOF ] ------------------------------------

