vendor:
Storystream
by:
v1per-haCker
9.3
CVSS
HIGH
Remote File Inclusion (RFI)
98
CWE
Product Name: Storystream
Affected Version From: 4
Affected Version To: 4
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2020
How I Can lives Without FooL Programmer!
Storystream is vulnerable to Remote File Inclusion (RFI) vulnerability. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. The attacker can execute arbitrary code on the vulnerable server by including malicious files from a remote location. The vulnerable scripts are include/classes/pear/DB/mysql.php and include/classes/pear/DB/mysqli.php. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server.
Mitigation:
The best way to mitigate RFI vulnerability is to restrict the file types that can be uploaded to the server. Also, the application should validate the user input and filter out any malicious code.
