vendor:
Mini-CMS
by:
cOndemned
7.5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: Mini-CMS
Affected Version From: 1.0.1
Affected Version To: 1.0.1
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Mini-CMS 1.0.1 (index.php) Multiple Local File Inclusion Vulnerabilities
Mini-CMS 1.0.1 is vulnerable to multiple local file inclusion vulnerabilities due to insufficient sanitization of user-supplied input. An attacker can exploit this vulnerability to include arbitrary local files, which can lead to remote code execution. This vulnerability is due to the application including files based on user-supplied input without proper sanitization. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing directory traversal sequences and a URL-encoded NULL byte (%00) to the vulnerable application. This will allow the attacker to include arbitrary local files, which can lead to remote code execution.
Mitigation:
Input validation should be used to ensure that untrusted data is not used to access local files. Additionally, access to the application should be restricted to trusted IP addresses.
