|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
In the php script pafiledb.php the value $action is used, but not declared. This can be exploited to insert arbitrary PHP code to be executed on the server from a web request.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Available
OSVDB:
Web Related
|
|
Technical |
At line 25 of pafiledb.php :
if ($login == "do") { include "./includes/$action/login.php"; exit; }
$action is used in above statement and it is not declared yet.
|
|
Solution |
As of March 31st 2005 PHP arena has announced that "Some security holes" have been closed. It does not name the specific holes however.
It is suggested by the discoverer of this vulnerability that removing line 25 of the script pafiledb.php resolves this issue.
|
|
Products |
|
paFileDB
 |
3.1 Final |
|
|
|
|
|
Credit |
- Pedram Hayati - pi3ch
 yahoo.com -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
