header-logo
Suggest Exploit
vendor:
WR-Meeting
by:
Cr@zy_King
7.5
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: WR-Meeting
Affected Version From: WR-Meeting v1.0
Affected Version To: WR-Meeting v1.0
Patch Exists: YES
Related CWE: CVE-2008-2490
CPE: cpe:a:wr-script:wr-meeting:1.0
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2008

Remote File Include Vulnerability in WR-Meeting v1.0

WR-Meeting v1.0 is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Mitigation:

Upgrade to WR-Meeting v1.1 or later.
Source

Exploit-DB raw data:

| By Cr@zy_King / crazy_kinq@hotmail.co.uk \

^| GrtZ : TheKacak - Crackers_Child - Rmx - TR_ip - Eno7 - DreamTurk - KnocKout - The_Bekir and str0ke \

^| WR-Meeting v1.0 FI \

^| Down : http://www.wr-script.ru/ \

^| Demo : http://www.wr-script.ru/meeting/

^| Info : t4sc1zkr4L Best Of Bug Researches

^| Files : index.php \

^| Rfi : http://localhost/index.php?event=coment&msnum=../config.php%00 \

---------

# milw0rm.com [2008-05-17]

Navigation

Suggest Exploit

Services By CQR