CVE-2004-0285
CRITICALAllMyGuests AllMyLinks AllMyVisitors - Remote File Inclusion via _AMVconfig[cfg_serverpath] Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2004-0285. PoCs published by Pablo Santana.
AI-analyzed exploit summary This exploit demonstrates a remote file inclusion vulnerability in AllMyPHP applications (AllMyGuests, AllMyLinks, AllMyVisitors) due to insufficient filtering of URI variables used in a 'require_once()' call. It allows remote command execution by injecting a malicious PHP script via the '_AMGconfig[cfg_serverpath]' parameter.
Description
PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.
Exploits (3)
This exploit demonstrates a remote file inclusion vulnerability in AllMyPHP applications (AllMyGuests, AllMyLinks, AllMyVisitors) due to insufficient filtering of URI variables used in a 'require_once()' call. It allows remote command execution by injecting a malicious PHP script via the '_AMGconfig[cfg_serverpath]' parameter.
This exploit demonstrates a remote file inclusion vulnerability in AllMyPHP applications (AllMyGuests, AllMyLinks, AllMyVisitors) due to insufficient filtering of URI variables used in a 'require_once()' call. It allows remote command execution by injecting a malicious URL into the '_AMLconfig[cfg_serverpath]' parameter.
This exploit demonstrates a remote file inclusion vulnerability in AllMyGuests due to insufficient filtering of URI variables used in a 'require_once()' call. It allows remote command execution by injecting a malicious URL containing a PHP script that executes system commands.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H