vendor:
Crafty Syntax Live Help
by:
SecurityFocus
7.5
CVSS
HIGH
Remote File-Include Vulnerabilities
94
CWE
Product Name: Crafty Syntax Live Help
Affected Version From: 2.9.2009
Affected Version To: 2.9.2009
Patch Exists: YES
Related CWE: N/A
CPE: a:craftysyntax:crafty_syntax_live_help
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
Crafty Syntax Live Help Multiple Remote File-Include Vulnerabilities
Crafty Syntax Live Help is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. Note that these issues affect only the version of Crafty Syntax Live Help that includes the Text Based Database Support package (Txt-db-api). Version 2.9.9 is vulnerable; other versions may also be affected.
Mitigation:
Input validation should be used to ensure that user-supplied data is properly sanitized.
