vendor:
Brim
by:
mdx and The_Bat_Hacker
8,8
CVSS
HIGH
Remote File Include
98
CWE
Product Name: Brim
Affected Version From: 1.2.0pre3
Affected Version To: 1.2.1
Patch Exists: YES
Related CWE: N/A
CPE: a:brim_project:brim
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Brim 1.2.0pre3, 1.2.1 renderer Remote File Include Vulnerability
Brim 1.2.0pre3 and 1.2.1 are vulnerable to a Remote File Include vulnerability. This vulnerability allows an attacker to include a remote file, usually through a malicious URL, and execute arbitrary code on the vulnerable server. The vulnerability exists due to the use of the 'renderer' parameter in multiple template files. An attacker can exploit this vulnerability by crafting a malicious URL and sending it to a victim. If the victim visits the malicious URL, the attacker-supplied file will be included and executed on the vulnerable server.
Mitigation:
The best way to mitigate this vulnerability is to ensure that user input is properly sanitized and validated. Additionally, the application should be updated to the latest version.
