vendor:
by:
x0r
7.5
CVSS
HIGH
LFI
22
CWE
Product Name:
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2008
LFI (Local File Inclusion)
The exploit allows an attacker to include local files on the server by manipulating the 'langage' parameter in the 'update.php' script. By using directory traversal techniques, the attacker can access sensitive files such as the '/etc/passwd' file. This vulnerability can be exploited to gain unauthorized access and retrieve sensitive information.
Mitigation:
To mitigate this vulnerability, it is recommended to validate and sanitize user input before using it in file inclusion operations. Additionally, access controls should be implemented to restrict the files that can be included.
