vendor:
Kure
by:
JosS
7.5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: Kure
Affected Version From: 2000.6.3
Affected Version To: 2000.6.3
Patch Exists: YES
Related CWE: N/A
CPE: a:kure:kure:0.6.3
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Kure 0.6.3 (index.php post,doc) Local File Inclusion Vulnerability
Kure 0.6.3 is vulnerable to Local File Inclusion. An attacker can exploit this vulnerability to include local files on the server. This vulnerability exists due to insufficient sanitization of user-supplied input to the 'post' and 'doc' parameters of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing directory traversal characters ('../') to the vulnerable script. This will allow the attacker to include local files on the server.
Mitigation:
Input validation should be used to ensure that user-supplied input is properly sanitized.
