AOH :: HP Unsorted R :: BT-30105.HTM

REZERVI (root) Remote Command Execution Vulnerability



REZERVI (root) Remote Command Execution Vulnerability
REZERVI (root) Remote Command Execution Vulnerability



REZERVI 3.0.2 Remote Command Execution Vulnerability=0D
=0D
http://eidelweiss-advisories.blogspot.com/2010/05/rezervi-302-remote-command-execution.html=0D 
=0D
-- Vulnerability Details:=0D
This vulnerability allows remote attackers to execute arbitrary code on=0D
vulnerable in directory "PATH/rezervi/include/mail.inc.php" with input "root" . Authentication is not=0D
required to exploit this vulnerability.=0D
=0D
# RFI Vulnerability! : [PATH/rezervi/include/mail.inc.php]=0D
#=0D
#		require_once($root."/include/phpmailer/phpmailer.inc.php");=0D
#=0D
# Because $root is not specific here , so attacker got RFI vulnerability and can exploit with Remote Command Execution (RCE) to upload or execute arbitrary shell code.=0D
=0D
-=[Version Affected]=-=0D
REZERVI 3.0.2 is Affected; Other or lowers version may also be affected.

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.