vendor:
PHPWebSite
by:
rgod
7.5
CVSS
HIGH
Arbitrary Local Inclusion
CWE
Product Name: PHPWebSite
Affected Version From: 2000.10.2
Affected Version To: 2000.10.2
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
Unknown
PHPWebSite <= 0.10.2 Remote Command Execution
This vulnerability allows an attacker to include files from local resources, which can lead to arbitrary code execution. The vulnerable code is present in the index.php file of PHPWebSite version 0.10.2 and below. By manipulating the 'hub_dir' parameter in the URL, an attacker can include files from local resources.
Mitigation:
Upgrade to a patched version of PHPWebSite.