Multiple input-validation issues in Simple Plantilla PHP

vendor:

Simple Plantilla PHP

by:

7.5

CVSS

HIGH

Input-validation issues, local file-include vulnerability, arbitrary file-upload vulnerability

CWE

Product Name: Simple Plantilla PHP

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Multiple input-validation issues in Simple Plantilla PHP

Attackers can exploit the local file-include vulnerability by using directory-traversal strings to execute local script code in the context of the application. Attackers can also exploit the arbitrary file-upload vulnerability to execute malicious PHP code in the context of the webserver process. Exploiting these issues may allow attackers to compromise the application and the underlying system or access sensitive information.

Mitigation:

Apply input validation checks to prevent directory traversal and restrict file-upload to only accept trusted file types. Update to a patched version of Simple Plantilla PHP.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/22669/info

Simple Plantilla PHP is prone to multiple input-validation issues, including a local file-include vulnerability and an arbitrary file-upload vulnerability.

Attackers can exploit the local file-include vulnerability using directory-traversal strings to execute local script code in the context of the application. Attackers can exploit the arbitrary file-upload to execute malicious PHP code in the context of the webserver process.

Exploiting these issues may allow attackers to compromise the application and the underlying system or to access sensitive information; other attacks are also possible. 

http://www.example.com/zadminxx/list_main_pages.php?nfolder=/etc/