FirePHPArbitrary 'createInstance()' Command Execution Vulnerability
BID:59362
Info
FirePHPArbitrary 'createInstance()' Command Execution Vulnerability
| Bugtraq ID: | 59362 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 22 2013 12:00AM |
| Updated: | Apr 22 2013 12:00AM |
| Credit: | Eldar "Wireghoul" Marcussen |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
FirePHPArbitrary 'createInstance()' Command Execution Vulnerability
FirePHP is prone to a remote arbitrary command-execution vulnerability because it fails to properly validate user-supplied input.
An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.
FirePHP 0.7.1 is vulnerable; other versions may also be affected.
FirePHP is prone to a remote arbitrary command-execution vulnerability because it fails to properly validate user-supplied input.
An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.
FirePHP 0.7.1 is vulnerable; other versions may also be affected.
Exploit / POC
FirePHPArbitrary 'createInstance()' Command Execution Vulnerability
Attackers can use a browser to exploit this issue.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Attackers can use a browser to exploit this issue.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Solution / Fix
FirePHPArbitrary 'createInstance()' Command Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
FirePHPArbitrary 'createInstance()' Command Execution Vulnerability
References:
References: