Virtual Hosting Control System SQL.PHP Remote File Include Vulnerability

Bugtraq ID:	12178
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2005 12:00AM
Updated:	Jan 06 2005 12:00AM
Credit:	This issue was reported by Kernelpanik Labs.
Vulnerable:	Virtual Hosting Control System Virtual Hosting Control System 2.2
Not Vulnerable:

Virtual Hosting Control System SQL.PHP Remote File Include Vulnerability

Virtual Hosting Control System is prone to a remote PHP file include vulnerability. This issue may allow a remote user to include a PHP script that originates from a remote server.

Exploitation of the issue would allow execution of malicious PHP code in the context of the Web server hosting the application.

Virtual Hosting Control System SQL.PHP Remote File Include Vulnerability

There is no exploit required.

Virtual Hosting Control System SQL.PHP Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Virtual Hosting Control System SQL.PHP Remote File Include Vulnerability

References:

• Virtual Hosting Control System Homepage (Virtual Hosting Control System)
  
• Virtual Hosting Control System Remote PHP Code Injection & Command Execution (Kernelpanik)