Secunia Advisory: SA10509 Print Advisory
Release Date: 2003-12-30

Critical: Highly critical
Impact: System access
Where: From remote

Software: PHP-Ping 1.x


Description:
ppp-design has reported a vulnerability in PHP-Ping, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to missing validation of input supplied to the "$count" variable. This can be exploited to execute arbitrary system commands by including them in a request.

Example:
http://[victim]/php-ping.php?count=1+%26+ls%20-l+%26&submit=Ping%21

Solution:
Update to version 1.2.
http://www.theworldsend.net/

Provided and/or discovered by:
ppp-design

Original Advisory:
http://www.ppp-design.de/advisor...executing_arbitrary_commands.txt

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News