vendor:
Agares PhpAutoVideo
by:
MhZ91
N/A
CVSS
HIGH
Remote File Inclusion + Local File Inclusion
CWE
Product Name: Agares PhpAutoVideo
Affected Version From: Agares PhpAutoVideo v2.21
Affected Version To: Agares PhpAutoVideo v2.21
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
Agares PhpAutoVideo v2.21 – Remote File Inclusion + Local File Inclusion
This exploit allows an attacker to include remote or local files in the vulnerable application. In the case of Local File Inclusion, an attacker can include files from the target system, potentially leading to information disclosure or remote code execution. In the case of Remote File Inclusion, an attacker can include arbitrary files from external servers, potentially leading to remote code execution.
Mitigation:
To mitigate the risk of Local File Inclusion, ensure that user-supplied input is properly validated and sanitized before being used in file inclusion functions. For Remote File Inclusion, avoid using user-supplied input to include files without proper validation and sanitization.
