AllMyVisitors 0.x Arbitrary Code Execution

ID EDB-ID:23698
Type exploitdb
Reporter Pablo Santana
Modified 2004-02-16T00:00:00


AllMyVisitors 0.x Arbitrary Code Execution. CVE-2004-0285. Webapps exploit for php platform

Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.
This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.[cfg_serverpath]=' will contain: