Info

Disclosure

Jun 28, 2006

Discovery

Unknown

Dates

Exploit

Jun 28, 2006

Solution

Unknown

Description

MF Piadas contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to admin/admin.php not properly sanitizing user input supplied to the 'page' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

MastersFusion

MF Piadas

1.0

References

Bugtraq ID: 18679
CVE ID: 2006-3323 (see also: NVD)
Secunia Advisory ID: 20847
Related OSVDB ID: 26868
VUPEN Advisory: ADV-2006-2567
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-06/0584.html
Other Advisory URL: http://kurdishsecurity.blogspot.com/2006/06/kurdish-security-10-mf-piadas-10.html
Vendor URL: http://www.mastersfusion.com.br/
Keyword: Kurdish Security # 10

Credit

Kurdish Security - -

Direct URL: http://osvdb.org/26867