Remote file inclusion

2006-05-0310:02:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.011 Low

EPSS

Percentile

84.8%

JSON

Dynamic variable evaluation vulnerability in index.php in Stadtaus Guestbook Script 1.7 and earlier, when register_globals is enabled, allows remote attackers to modify arbitrary program variables via parameters, which are evaluated as PHP variable variables, as demonstrated by performing PHP remote file inclusion using the include_files array parameter.

CPENameOperatorVersion
guestbook_scriptle1.7

CPE	Name	Operator	Version
	guestbook_script	le	1.7

References

retrogod.altervista.org/gbs_17_xpl_pl.html

secunia.com/advisories/19957

www.securityfocus.com/bid/17845

www.stadtaus.com/forum/t-2600.html

www.vupen.com/english/advisories/2006/1660

exchange.xforce.ibmcloud.com/vulnerabilities/26252