vendor:
New CMS
by:
Xash
7,5
CVSS
HIGH
Local File Inclusion
98
CWE
Product Name: New CMS
Affected Version From: <= 1.12
Affected Version To: <= 1.12
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
New CMS Local File Inclusion
New CMS is vulnerable to Local File Inclusion (LFI) vulnerability. An attacker can exploit this vulnerability to include local files on the server and execute arbitrary code. The vulnerable parameter is 'pg' which is not properly sanitized before being used in the include() function.
Mitigation:
Input validation should be used to prevent the inclusion of malicious files. The application should also be configured to use a whitelist of allowed files and directories.
