Clansys Index.PHP Remote Code Execution Vulnerability

Bugtraq ID:	17660
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 24 2006 12:00AM
Updated:	Apr 24 2006 06:31PM
Credit:	NukedX is credited with the discovery of this vulnerability.
Vulnerable:	Clansys Clansys 1.1
Not Vulnerable:

Clansys Index.PHP Remote Code Execution Vulnerability


Clansys is prone to an arbitrary code-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible.

Clansys Index.PHP Remote Code Execution Vulnerability


This issue can be exploited via a web client.

Clansys Index.PHP Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]

Clansys Index.PHP Remote Code Execution Vulnerability

References:

• Clansys (Clanscripte.net)
  
• ClanSys v1.1 (index.php page) PHP Code Insertion Vulnerability (nukedx)