vendor:
calsnails module
by:
bd0rk || SOH-Crew
7,5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: calsnails module
Affected Version From: 1.06
Affected Version To: 1.06
Patch Exists: YES
Related CWE: N/A
CPE: mxbb:calsnails_module:1.06
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
mxBB calsnails module 1.06 Remote File Inclusion Vulnerability
A vulnerability exists in mxBB calsnails module 1.06 which allows a remote attacker to include a file from a remote host. The vulnerability is due to the 'module_root_path' parameter in 'includes/mx_common.php' script not properly sanitized before being used in a 'include_once' function call. This can be exploited to include arbitrary files from remote hosts by e.g. passing a URL in the 'module_root_path' parameter.
Mitigation:
The vendor has released a patch to address this vulnerability. Users are advised to upgrade to the latest version of mxBB calsnails module.
