OSVDB ID: 24291 Title: QLnews config.php Arbitrary PHP Code Execution |
Info |
|
|
Dates |
||||
|
|
Description |
QLnews contains a flaw that may allow a malicious user to execute arbitrary code. The issue is due to the the administrator having permission to add any content to the config.php script. Once modified to contain arbitrary PHP code, an attacker can call the script directly to execute the code. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Rumored OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
|
References |
|
Credit |
|
evuln.com - eVuln