header-logo
Suggest Exploit
vendor:
phpMyVisites
by:
SecurityFocus
7.5
CVSS
HIGH
Arbitrary File Inclusion
94
CWE
Product Name: phpMyVisites
Affected Version From: 1.3
Affected Version To: 1.3
Patch Exists: YES
Related CWE: N/A
CPE: a:phpmyvisites:phpmyvisites:1.3
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2005

phpMyVisites Arbitrary File Inclusion Vulnerability

phpMyVisites allows attackers to include arbitrary files. While it has been demonstrated that local files may be included through this vulnerability, there is an unconfirmed possibility of remote file inclusion. Exploitation could disclose local files, or in the case of remote file inclusion, let the attacker execute malicious PHP code.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in file operations.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/13370/info

phpMyVisites allows attackers to include arbitrary files. While it has been demonstrated that local files may be included through this vulnerability, there is an unconfirmed possibility of remote file inclusion.

Exploitation could disclose local files, or in the case of remote file inclusion, let the attacker execute malicious PHP code.

The issue is known to affect phpMyVisites 1.3. Other versions may also be affected. 

<form action="http://[pathtoyourphpMyVisites]/login.php" method="POST">
Local file: <input type="text" name="mylang" value="" />
<input type="submit" value="Alexx says RELAX!">
</form>

Navigation

Suggest Exploit

Services By CQR