vendor:
Simply Sites RGV
by:
DevilZ TM
7,5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: Simply Sites RGV
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
Simply Sites RGV Local File Inclusion
Simply Sites RGV is vulnerable to Local File Inclusion vulnerability. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. The maliciously crafted request contains a maliciously crafted page_id parameter which contains a relative path to the file which the attacker wants to include. For example, an attacker can send a maliciously crafted request like http://127.0.0.1/payment.php?page_id=../../../../../../../../etc/passwd to include the /etc/passwd file.
Mitigation:
The best way to mitigate this vulnerability is to restrict the access to the vulnerable file and validate the user input.
