The remote system contains a PHP application that is prone to remote file inclusions attacks. Description : Aardvark Topsites PHP is installed on the remote host. It is a open source Toplist management system written in PHP. The application does not sanitize user-supplied input to the 'CONFIG[PATH]' variable in some PHP files. This allows an attacker to include arbitrary files from remote systems, and execute them with privileges under which the webserver operates. The flaw is exploitable if PHP's 'register_globals' is set to on.
Disable PHP's 'register_globals' or upgrade to the latest release.
- Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
- Apache Struts2 'XWork' Information Disclosure Vulnerability
- APC PowerChute Network Shutdown HTTP Response Splitting Vulnerability
- Apache Solr XML External Entity(XXE) Vulnerability-01 Jan-14
- Apache Tomcat cal2.jsp Cross Site Scripting Vulnerability