vendor:
Sabdrimer CMS
by:
A.nosrati
7,5
CVSS
HIGH
Remote File Include
98
CWE
Product Name: Sabdrimer CMS
Affected Version From: 2.2.4
Affected Version To: 2.2.4
Patch Exists: NO
Related CWE: N/A
CPE: a:sabdrimer:sabdrimer_cms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
Sabdrimer PRO (v.2.2.4 ) Remote File Include Vulnerability
Sabdrimer PRO (v.2.2.4 ) is vulnerable to a Remote File Include vulnerability. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'pluginpath[0]' parameter of the 'advanced1.php' script. An attacker can exploit this vulnerability to execute arbitrary PHP code on the vulnerable system by sending a specially crafted HTTP request containing malicious code. The vulnerability is only exploitable if the 'register_globals' PHP option is set to 'On'.
Mitigation:
Disable the 'register_globals' PHP option and ensure that user-supplied input is properly sanitized.
