vendor:
CMS Firebrand Tec
by:
R3VAN_BASTARD
7,5
CVSS
HIGH
Local File Inclusion
98
CWE
Product Name: CMS Firebrand Tec
Affected Version From: V.1.x
Affected Version To: V.1.x
Patch Exists: NO
Related CWE: N/A
CPE: a:firebrand_technologies:cms_firebrand_tec
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
CMS Firebrand Tec Local File Inclusion Vulnerability
A Local File Inclusion (LFI) vulnerability exists in CMS Firebrand Tec, which allows an attacker to include a file from the local file system of the web server. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can be done by appending a maliciously crafted string to the vulnerable parameter in the HTTP request. This can allow an attacker to include a file from the local file system of the web server, such as the application source code, configuration and critical system files, and even the web server’s password file.
Mitigation:
The best way to mitigate this vulnerability is to ensure that the application is not vulnerable to directory traversal attacks. This can be done by validating user input and sanitizing it before using it in the application. Additionally, the application should be configured to only allow access to files that are necessary for the application to function.
