vendor:
Loggix Project
by:
cr4wl3r
7.5
CVSS
HIGH
Remote File Include
98
CWE
Product Name: Loggix Project
Affected Version From: 9.4.5 and below
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Loggix Project <= 9.4.5 Multiple Remote File Include Vulnerability
Loggix Project version 9.4.5 and below is vulnerable to multiple remote file include vulnerability. The vulnerable files are Calendar.php, Comment.php, Rss.php, Trackback.php and LM_Downloads.php. The vulnerability exists in the require_once $pathToIndex . '/lib/Loggix/Module.php'; statement. An attacker can exploit this vulnerability by sending a malicious URL to the vulnerable application. The malicious URL contains the path to the attacker's malicious file which will be included in the vulnerable application.
Mitigation:
The application should be updated to the latest version of Loggix Project. Input validation should be done to prevent malicious input from being passed to the application.
