MyDLstore Meta Search Engine Script 'url' Parameter Remote File Include Vulnerability
BID:43455
Info
MyDLstore Meta Search Engine Script 'url' Parameter Remote File Include Vulnerability
| Bugtraq ID: | 43455 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 21 2009 12:00AM |
| Updated: | Jul 21 2009 12:00AM |
| Credit: | Moudi |
| Vulnerable: |
MyDLstore Meta Search Engine Script 1.0 |
| Not Vulnerable: | |
Discussion
MyDLstore Meta Search Engine Script 'url' Parameter Remote File Include Vulnerability
MyDLstore Meta Search Engine Script is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
MyDLstore Meta Search Engine Script 1.0 is vulnerable; other versions may also be affected.
MyDLstore Meta Search Engine Script is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
MyDLstore Meta Search Engine Script 1.0 is vulnerable; other versions may also be affected.
Exploit / POC
MyDLstore Meta Search Engine Script 'url' Parameter Remote File Include Vulnerability
Attackers can exploit this issue through a browser.
The following example URI is available:
http://www.example.com/metasearch/index.php?url=evilcode.txt?&file=Search
Attackers can exploit this issue through a browser.
The following example URI is available:
http://www.example.com/metasearch/index.php?url=evilcode.txt?&file=Search