vendor:
LMS
by:
Kacper
7.5
CVSS
HIGH
Remote File Inclusion
CWE
Product Name: LMS
Affected Version From: LMS version 1.8.9 and below
Affected Version To: LMS version 1.8.9
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
LMS <= 1.8.9 Vala Remote File Inclusion Vulnerabilities
The LMS <= 1.8.9 Vala script is vulnerable to remote file inclusion attacks. The vulnerabilities can be exploited by an attacker by injecting malicious code into the userpanel_dir and _LIB_DIR parameters. This can lead to arbitrary code execution and unauthorized access to sensitive information.
Mitigation:
To mitigate these vulnerabilities, it is recommended to update LMS to a version higher than 1.8.9. Additionally, input validation and sanitization should be implemented to prevent remote file inclusion attacks.
