Admbook PHP Code Injection Flaw

  1. Network Vulnerabilities
  2. Web application abuses
  3. Admbook PHP Code Injection Flaw
Summary
The remote web server contains a PHP script that allows arbitrary code injection. Description : The remote host is running AdmBook, a PHP-based guestbook. The remote version of this software is prone to remote PHP code injection due to a lack of sanitization of the HTTP header 'X-Forwarded-For'. Using a specially-crafted URL, a malicious user can execute arbitrary command on the remote server subject to the privileges of the web server user id.
Solution
Unknown at this time.
References
Updated on 2015-03-25
Severity
High Severity
Classification
Related Vulnerabilities