vendor:
Mailing List Manager
by:
str0ke
7.5
CVSS
HIGH
Remote File Include
98
CWE
Product Name: Mailing List Manager
Affected Version From: 1.3e
Affected Version To: 1.3e
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
WEBInsta Mailing List Manager <= 1.3e (initdb.php) Remote File Include Exploit
The vulnerable code snippet does not stop post requests to the absolute_path variable, allowing an attacker to inject malicious code into the application. An attacker can use a r57shell with a twist to exploit this vulnerability.
Mitigation:
Input validation should be used to prevent malicious code from being injected into the application.
