MAXSITE Guestbook Component 'message' Parameter Remote Command Execution Vulnerability

Bugtraq ID:	32588
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2008 12:00AM
Updated:	Dec 03 2008 09:21PM
Credit:	CWH Underground
Vulnerable:	MAXSITE Guestbook Component 0
Not Vulnerable:

MAXSITE Guestbook Component 'message' Parameter Remote Command Execution Vulnerability

MAXSITE Guestbook Component is prone to a vulnerability that attackers can leverage to execute arbitrary commands in the context of the application. This issue occurs because the application fails to adequately sanitize user-supplied input.

Remote attackers may exploit this issue to execute arbitrary PHP commands within the context of the vulnerable webserver.

MAXSITE Guestbook Component 'message' Parameter Remote Command Execution Vulnerability

Attackers can exploit the issue via a browser.

The following example exploit is available:

• /data/vulnerabilities/exploits/32588.pl

MAXSITE Guestbook Component 'message' Parameter Remote Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MAXSITE Guestbook Component 'message' Parameter Remote Command Execution Vulnerability

References:

• MAXSITE Homepage (MAXSITE)