Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability

Bugtraq ID:	20781
Class:	Input Validation Error
CVE:	CVE-2006-5762
Remote:	Yes
Local:	No
Published:	Oct 28 2006 12:00AM
Updated:	Mar 27 2007 09:53PM
Credit:	Kacper has been credited with the discovery of this vulnerability.
Vulnerable:	Free PHP Scripts Free File Hosting 1.1
Not Vulnerable:

Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability

Free File Hosting is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Free File Hosting 1.1 and prior versions are vulnerable.

Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability

An attacker may exploit this issue using a web client.

The following exploit code is available:

• /data/vulnerabilities/exploits/20781.php

Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability

References:

• Free PHP Scripts Homepage (Free PHP Scripts)
  
• File Upload System V1.0 (AD_BODY_TEMP) multiple file include ([email protected])