vendor:
WebCAF
by:
dun
8.8
CVSS
HIGH
Arbitrary File Delete, LFI, RCE
22, 98, 78
CWE
Product Name: WebCAF
Affected Version From: 1.4
Affected Version To: 1.4
Patch Exists: No
Related CWE: N/A
CPE: a:webcaf:webcaf:1.4
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
WebCAF <= 1.4 Multiple Remote Vulnerabilities
WebCAF is a web-based child and family database developed by Head Start of Lane County. It contains three vulnerabilities, an Arbitrary File Delete vulnerability, a Local File Inclusion vulnerability, and a Remote Code Execution vulnerability. The Arbitrary File Delete vulnerability is present in the index.php file, lines 49-50 and 61-63. The Local File Inclusion vulnerability is present in the index.php file, lines 68-131, and the Remote Code Execution vulnerability is also present in the index.php file, lines 68-131. The view.php file also contains a Local File Inclusion vulnerability, lines 12-21.
Mitigation:
The Arbitrary File Delete vulnerability can be mitigated by removing the unlink() function from the index.php file. The Local File Inclusion vulnerability can be mitigated by removing the include() function from the index.php and view.php files. The Remote Code Execution vulnerability can be mitigated by removing the include() function from the index.php file.
