VideoScript 'admin/homeset.php' Remote PHP Code Injection Vulnerability

Bugtraq ID:	32468
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 24 2008 12:00AM
Updated:	Nov 26 2008 03:34PM
Credit:	G4N0K
Vulnerable:	Videoscript.co.uk VideoScript 4.1.5 55 Videoscript.co.uk VideoScript 4.0.1 50
Not Vulnerable:

VideoScript 'admin/homeset.php' Remote PHP Code Injection Vulnerability

VideoScript is prone to a vulnerability that can be leveraged to execute arbitrary PHP code because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

This issue affects VideoScript 4.0.1.50 and 4.1.5.55; other versions may also be affected.

VideoScript 'admin/homeset.php' Remote PHP Code Injection Vulnerability

Attackers can exploit the issue via a browser.

The following example exploit is available.

NOTE: Symantec has not verified the contents of this exploit; always use caution when handling exploits.

• /data/vulnerabilities/exploits/32468.php

VideoScript 'admin/homeset.php' Remote PHP Code Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

VideoScript 'admin/homeset.php' Remote PHP Code Injection Vulnerability

References:

• VideoScript Homepage (Videoscript.co.uk)