vendor:
Study planner (Studiewijzer)
by:
M.Hasran Addahroni
N/A
CVSS
N/A
Remote File Inclusion
CWE
Product Name: Study planner (Studiewijzer)
Affected Version From: <= 0.15
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
Study planner (Studiewijzer) <= 0.15 Remote File Inclusion Vulnerability
The application Study planner (Studiewijzer) version <= 0.15 is vulnerable to remote file inclusion. The include function at inc/service.alert.inc.php does not properly sanitize the $SPL_CFG['dirroot'] variable, allowing an attacker to include and execute arbitrary files from a remote location.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize user input properly before including any files. Additionally, disabling register_globals can also help prevent this vulnerability.