MyPHPCommander *gl_root* File Inclusion Vulnerability

Posted on Monday, January 29, 2007 @ 10:58:43 PST in Security
by Raven

SECUNIA ADVISORY ID: SA23890

VERIFY ADVISORY: http://secunia.com/advisories/23890/

CRITICAL: Highly critical

IMPACT: System access

SOFTWARE: MyPHPCommander 2.x - http://secunia.com/product/13364/

DESCRIPTION: Cold z3ro has reported a vulnerability in MyPHPCommander, which can be exploited by malicious people to compromise vulnerable systems.
Input passed to the "gl_root" parameter in system/lib/package.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources. Successful exploitation requires that "register_globals" is enabled. The vulnerability is reported in version 2.0. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly verified.

PROVIDED AND/OR DISCOVERED BY: Cold z3ro

ORIGINAL ADVISORY: http://milw0rm.com/exploits/3201
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 361,617,490
  • Today: 31,847
Server InfoServer Info
  • Jul 16, 2018
  • 07:38 am PDT
 
 

Daily Inspiration