SysCP 1.2.x - Multiple Script Execution Vulnerabilities

2005-08-08T00:00:00
ID EDB-ID:26103
Type exploitdb
Reporter Christopher Kunz
Modified 2005-08-08T00:00:00

Description

SysCP 1.2.x Multiple Script Execution Vulnerabilities. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/14490/info

SysCP is affected by multiple script execution vulnerabilities.

The following specific vulnerabilities were identified:

The application is affected by a remote file include vulnerability. An attacker can include remote script code and execute it in the context of an affected server.

Another script code execution vulnerability may allow an attacker to call arbitrary functions and scripts by bypassing a PHP eval() statement.

SysCP 1.2.10 and prior versions are prone to these vulnerabilities.

The following string is sufficient to bypass the eval() call:
{${phpinfo();}}