vendor:
PHP Movie Review
by:
milw0rm.com
7,5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: PHP Movie Review
Affected Version From: <=2B
Affected Version To: <=2B
Patch Exists: YES
Related CWE: N/A
CPE: a:built2go:php_movie_review:2b
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2006
Built2Go PHP Movie Review <=2B Remote File Inclusion Vulnerability
In the movie_cls.php file, the require_once() function is used to include a file from a user-supplied input. This can be exploited to include arbitrary files from remote locations by passing a URL in the full_path parameter. This can be used to execute arbitrary commands on the vulnerable system.
Mitigation:
Input validation should be used to ensure that user-supplied input is not used to include files from external locations.
