vendor:
Cafelog
by:
SecurityFocus
7.5
CVSS
HIGH
Remote File Include
98
CWE
Product Name: Cafelog
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
Remote File Include Vulnerability in Cafelog
A remote file include vulnerability has been reported for Cafelog. Due to insufficient sanitization of some user-supplied variables by the 'blogger-2-b2.php' and 'gm-2-b2.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL. If the remote file is a malicious PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the web server.
Mitigation:
Input validation should be used to ensure that user-supplied variables are properly sanitized.
