PHPGedView Multiple Remote Script Code Execution Vulnerabilities

Bugtraq ID:	15983
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2005 12:00AM
Updated:	Dec 20 2005 12:00AM
Credit:	rgod is credited with the discovery of this vulnerability.
Vulnerable:	PhpGedView PhpGedView 3.3.7 PhpGedView PhpGedView 2.65.2 PhpGedView PhpGedView 2.65.1 PhpGedView PhpGedView 2.65 beta5 PhpGedView PhpGedView 2.65 PhpGedView PhpGedView 2.61.1 PhpGedView PhpGedView 2.61 PhpGedView PhpGedView 2.60 PhpGedView PhpGedView 2.52.3
Not Vulnerable:

PHPGedView Multiple Remote Script Code Execution Vulnerabilities

PHPGedView is prone to remote and local file include and PHP script code execution vulnerabilities.

An attacker can exploit these issues to include an arbitrary local or remote file containing malicious PHP code and execute it in the context of the Web server process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

PHPGedView Multiple Remote Script Code Execution Vulnerabilities

No exploit is required.

Sample exploit code has been provided.

• /data/vulnerabilities/exploits/php_ged_view_337_xpl.php

PHPGedView Multiple Remote Script Code Execution Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPGedView Multiple Remote Script Code Execution Vulnerabilities

References:

• PhpGedView Homepage (PhpGedView)
  
• PHPGedView <= 3.3.7 remote code execution (rgod)