Release Date

Severity

Impact

Description

It indicates a possible exploit of remote file include vulnerability in MyGuestbook software package.

MyGuestbook is a freely available CGI guestbook script, which allows users to leave their name, e-mail and comments. A remote php code inclusion vulnerability is reported in it that may allow an attacker to execute arbitrary server side script code on the affected system with privilege of web server process. Due to insufficient sanitization of user input by form.inc.php3 script, an attacker may modify lang parameter on a HTTP request to reference a URL on a remote web server that contains the malicious code. An attacker may exploit this to execute arbitrary code on the affected system and gain access to it.

Affected Products

Recommended Actions

Coverage

Common Vulnerabilities and Exposures (CVE)

Reference/s