vendor:
txtshop
by:
Pepelux
8.8
CVSS
HIGH
Local File Inclusion Vulnerability
98
CWE
Product Name: txtshop
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE: N/A
CPE: txtshop
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
txtshop – beta 1.0 / Local File Inclusion Vulnerability
A Local File Inclusion vulnerability exists in txtshop version 1.0. The vulnerability is due to the 'language' parameter in the 'header.php' script not being properly sanitized before being used in an 'include_once' function call. This can be exploited to include arbitrary files from local resources via directory traversal attacks. Successful exploitation requires that 'register_globals' is set to 'on'.
Mitigation:
Input validation should be used to ensure that user-supplied input is properly sanitized before being used in 'include_once' function calls.
