vendor:
Weather for PHP
by:
BorN To K!LL
5.5
CVSS
MEDIUM
Local File Include
File Inclusion
CWE
Product Name: Weather for PHP
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
2007
Weather for PHP <= (PageName) Local File Include Vulnerability
The vulnerability exists in the Weather for PHP script version 1.0. It allows an attacker to include arbitrary local files by manipulating the 'PageName' parameter in the 'index.php' file. By appending '%00' to the 'PageName' parameter, an attacker can bypass the file extension check and include any local file on the server.
Mitigation:
To mitigate this vulnerability, it is recommended to sanitize user input and validate the 'PageName' parameter to prevent any malicious file inclusion.
