Free FAQ Index.PHP Remote File Include Vulnerability
BID:20621
Info
Free FAQ Index.PHP Remote File Include Vulnerability
| Bugtraq ID: | 20621 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 19 2006 12:00AM |
| Updated: | Nov 20 2006 11:00PM |
| Credit: | FIXXXER FIXXXER is credited with the discovery of this vulnerability. |
| Vulnerable: |
Free Faq Free Faq 1.0.e |
| Not Vulnerable: |
Free Faq Free Faq 1.0.f |
Discussion
Free FAQ Index.PHP Remote File Include Vulnerability
Free Faq is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
Version 1.0.e is vulnerable to this issue.
Free Faq is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
Version 1.0.e is vulnerable to this issue.
Exploit / POC
Free FAQ Index.PHP Remote File Include Vulnerability
Attackers can exploit this issue via a web client.
The following exploit code is available:
Attackers can exploit this issue via a web client.
The following exploit code is available:
Solution / Fix
Free FAQ Index.PHP Remote File Include Vulnerability
Solution:
The vendor released version 1.0f to address this issue. Please see the references section for further information.
Solution:
The vendor released version 1.0f to address this issue. Please see the references section for further information.