vendor:
pithcms
by:
eidelweiss
8,8
CVSS
HIGH
pithcms (theme) Local / remote File inclusion VUlnerability
98
CWE
Product Name: pithcms
Affected Version From: 0.9.5.1
Affected Version To: 0.9.5.1
Patch Exists: NO
Related CWE: N/A
CPE: a:pithcms:pithcms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2009
pithcms (theme) Local / remote File inclusion VUlnerability
pithcms is vulnerable to local and remote file inclusion. An attacker can exploit this vulnerability to include malicious files from remote locations and execute arbitrary code on the vulnerable system. The vulnerability exists due to insufficient sanitization of user-supplied input to the 'theme' parameter in 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing directory traversal characters.
Mitigation:
Input validation should be performed to ensure that user-supplied input is properly sanitized.
