EasyPHP – ‘/index.php’ Authentication Bypass / Remote PHP Code Injection

Exploit Database
145 阅读

作者： KedAns-Dz

日期： 2013-04-09
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/38438/

source: https://www.securityfocus.com/bid/58945/info

EasyPHP is prone to an authentication bypass and a PHP code execution vulnerability.

Attackers may exploit these issues to gain unauthorized access to the affected application and perform arbitrary actions or execute arbitrary PHP code within the context of the web server process. Successful attacks can compromise the affected application and possibly the underlying computer.

EasyPHP 12.1 is vulnerable; other versions may also be affected.

http://www.example.com/home/index.php?to=ext

http://www.example.com/home/index.php?to=phpinfo

last Exploits
EasyPHP – ‘/index.php’ Authentication Bypass / Remote PHP Code Injection的更多信息

Nagios Incident Manager 2.0.0 – Multiple Vulnerabilities：
Chyrp 2.x swfupload Extension – ‘upload_handler.php’ Arbitrary File Upload / Arbitrary PHP Code Execution：
DotNetNuke 07.04.00 – Administration Authentication Bypass：
eClinicalWorks (CCMR) – Multiple Vulnerabilities：
TP-Link TL-WR1043ND 2 – Authentication Bypass：
PEAR LiveUser < 0.16.8 - Arbitrary File Access：
LeadPro CRM v1.0 – SQL Injection：
CmyDocument – Multiple Cross-Site Scripting Vulnerabilities：