vendor:
PhreeBooks R30RC4
by:
AutoSec Tools
8.8
CVSS
HIGH
Local File Inclusion and Reflected Cross-site Scripting
98, 79
CWE
Product Name: PhreeBooks R30RC4
Affected Version From: PhreeBooks R30RC4
Affected Version To: PhreeBooks R30RC4
Patch Exists: NO
Related CWE: N/A
CPE: a:phreebooks:phreebooks_r30rc4
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows Vista + XAMPP
2011
PhreeBooks R30RC4 Local File Inclusion and Reflected Cross-site Scripting
PhreeBooks R30RC4 is vulnerable to Local File Inclusion and Reflected Cross-site Scripting. An attacker can exploit this vulnerability by sending a maliciously crafted URL to the target server. The malicious URL contains a malicious script which is then executed by the web server. The malicious script can be used to steal sensitive information or execute arbitrary code on the target server.
Mitigation:
To mitigate this vulnerability, the application should be configured to only allow access to files that are necessary for the application to function. Additionally, input validation should be performed to ensure that user-supplied data is not used to access files outside of the application's directory structure.
