|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
QLnews contains a flaw that may allow a malicious user to execute arbitrary code. The issue is due to the the administrator having permission to add any content to the config.php script. Once modified to contain arbitrary PHP code, an attacker can call the script directly to execute the code.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Rumored / Private
OSVDB:
Web Related
|
|
Technical |
An attacker must supply valid administrator authentication credentials in order to exploit this vulnerability.
This vulnerability is only present when the magic_quotes_gpc PHP option is 'off'.
|
|
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
|
|
Products |
|
QLnews
 |
1.2 |
|
|
|
|
Credit |
- Aliaksandr Hartsuyeu - alex
 evuln.com - eVuln
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
