vendor:
SeoToaster Ecommerce
by:
Ihsan Sencan
7.5
CVSS
HIGH
Local File Inclusion
98
CWE
Product Name: SeoToaster Ecommerce
Affected Version From: 3.0.0
Affected Version To: 3.0.0
Patch Exists: NO
Related CWE: N/A
CPE: a:seotoaster:seotoaster_ecommerce:3.0.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: WiN7_x64/KaLiLinuX_x64
2019
SeoToaster Ecommerce 3.0.0 – Local File Inclusion
SeoToaster Ecommerce 3.0.0 is vulnerable to Local File Inclusion. An attacker can exploit this vulnerability to include a local file on the web server. This can be exploited by sending a specially crafted HTTP POST request to the vulnerable application. The POST request should contain the parameter 'getcss' or 'getjs' with the value '../index.php'. This will allow an attacker to include a local file on the web server.
Mitigation:
The application should validate the user input and should not allow the user to include any local file on the web server.