i-dreams.net GB 5.4 Final

vendor:

i-dreams.net GB

by:

Pouya_Server

7.5

CVSS

HIGH

Remote File Include

CWE

Product Name: i-dreams.net GB

Affected Version From: 5.4 Final

Affected Version To: 5.4 Final

Patch Exists: YES

Related CWE: N/A

CPE: a:i-dreams.net:i-dreams.net_gb

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

This vulnerability allows remote attackers to execute arbitrary PHP code on vulnerable installations of i-dreams.net GB 5.4 Final. Authentication is not required to exploit this vulnerability. The specific flaw exists within the 'firebook/data/admdat/admin.dat' script. This script fails to properly sanitize user-supplied input to the 'page' variable. An attacker can leverage this vulnerability to execute arbitrary PHP code under the context of the webserver.

Mitigation:

Upgrade to the latest version of i-dreams.net GB 5.4 Final or apply the patch from the vendor.

Source

Exploit-DB raw data:

#########################################################
---------------------------------------------------------
Portal Name: i-dreams.net GB
Version : 5.4 Final
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Website: http://Pouya-Server.ir
---------------------------------------------------------
#########################################################
[Xpl]:
http://site.com/firebook/data/admdat/admin.dat
------------------------------------------
Victem :
http://www.elsapo77.com
http://www.astro-partner.eu/cgi-bin
http://www.zarembowicz.de/cgi-bin
---------------------------------------------------------
#########################################################

# milw0rm.com [2009-02-20]