|
|
Family: CGI abuses --> Category: attack
Atomic Photo Album apa_module_basedir Variable File Include Vulnerability Vulnerability Scan
Vulnerability Scan Summary
Checks for apa_module_basedir variable file include vulnerability in Atomic Photo Album
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP script that is vulnerable to a
remote file inclusion attack.
Description :
The remote host is running Atomic Photo Album, a free, PHP-based photo
gallery.
The installed version of Atomic Photo Album allows remote attackers to
control the 'apa_module_basedir' variable used when including PHP code
in the 'apa_phpinclude.inc.php' script. By leveraging this flaw, an
attacker may be able to view arbitrary files on the remote host and
execute arbitrary PHP code, possibly taken from third-party hosts.
See also :
http://www.securityfocus.com/archive/1/406364/30/0/threaded
Solution :
Ensure that PHP's 'magic_quotes_gpc' setting is enabled and
that 'allow_url_fopen' is disabled.
Threat Level:
High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
