|
|
Family: CGI abuses --> Category: attack
Monster Top List Remote File Include Vulnerability Scan
Vulnerability Scan Summary
Checks for file includes in sources/functions.php
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a PHP application that is affected by a
remote file include vulnerability.
Description :
The remote host is running Monster Top List, a site rating script
written in PHP.
The installed version of Monster Top List fails to sanitize user input
to the 'root_path' parameter in sources/functions.php before using it
to include PHP code from other files. An unauthenticated attacker may
be able to read arbitrary local files or include a file from a remote
host that contains commands which will be executed on the remote host
subject to the rights of the web server process.
This flaw is only exploitable if PHP's 'register_globals' is enabled.
See also :
http://pridels.blogspot.com/2006/04/monstertoplist.html
Solution :
Unknown at this time.
Threat Level:
High / CVSS Base Score : 7.0
(AV:R/AC:L/Au:NR/C:P/I:P/A:P/B:N)
Click HERE for more information and discussions on this network vulnerability scan.
|
