REZERVI (root) Remote Command Execution Vulnerability May 07 2010 12:10AM
eidelweiss cyberservices com
REZERVI 3.0.2 Remote Command Execution Vulnerability


-- Vulnerability Details:

This vulnerability allows remote attackers to execute arbitrary code on

vulnerable in directory "PATH/rezervi/include/mail.inc.php" with input "root" . Authentication is not

required to exploit this vulnerability.

# RFI Vulnerability! : [PATH/rezervi/include/mail.inc.php]


# require_once($root."/include/phpmailer/phpmailer.inc.php");


# Because $root is not specific here , so attacker got RFI vulnerability and can exploit with Remote Command Execution (RCE) to upload or execute arbitrary shell code.

-=[Version Affected]=-

REZERVI 3.0.2 is Affected; Other or lowers version may also be affected.

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus