vendor:
Dazzle Blast
by:
NoGe
7.5
CVSS
HIGH
Remote File Inclusion
94
CWE
Product Name: Dazzle Blast
Affected Version From: 1
Affected Version To: 1
Patch Exists: Yes
Related CWE: CVE-2008-4456
CPE: a:dazzle_blast:dazzle_blast
Metasploit:
https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2009-1289/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0110/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2009-1461/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2008-4456/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2008-4456/, https://www.rapid7.com/db/vulnerabilities/apple-osx-mysql-cve-2008-4456/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2008-4456/
Other Scripts:
https://www.infosecmatter.com/nessus-plugin-library/?id=60735, https://www.infosecmatter.com/nessus-plugin-library/?id=44635, https://www.infosecmatter.com/nessus-plugin-library/?id=41313, https://www.infosecmatter.com/nessus-plugin-library/?id=38642, https://www.infosecmatter.com/nessus-plugin-library/?id=36943, https://www.infosecmatter.com/nessus-plugin-library/?id=41421, https://www.infosecmatter.com/nessus-plugin-library/?id=57446, https://www.infosecmatter.com/nessus-plugin-library/?id=45372, https://www.infosecmatter.com/nessus-plugin-library/?id=42015, https://www.infosecmatter.com/nessus-plugin-library/?id=58325
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2008
Dazzle Blast Remote File Inclusion Vulnerability
The vulnerability exists due to insufficient sanitization of user input in the 'require_once($ROOTDIR.'admin/functions/general.php')' parameter in the 'admin/includes/createemails.php' script. This can be exploited to include arbitrary files from remote locations by using a URL in the 'ROOTDIR' parameter in a HTTP request.
Mitigation:
The vulnerability can be mitigated by validating user input and sanitizing the input before using it in the application.
