vendor:
Gigs
by:
bd0rk
N/A
CVSS
MEDIUM
Local File Inclusion
CWE
Product Name: Gigs
Affected Version From: 1.2.2001
Affected Version To: 1.2.2001
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
Gigs 1.2.1 (activateuser.php) Local File Inclusion Vulnerability
The vulnerability allows an attacker to include files from the local file system by manipulating the 'language' parameter in the activateuser.php script. By specifying a relative path to the '/etc/passwd' file, an attacker can read sensitive information such as usernames and hashed passwords.
Mitigation:
The vendor should sanitize user input and avoid directly including files based on user input. It is recommended to use absolute paths or restrict the inclusion to a specific directory.
