Intrusion PreventionOFFL.DOC.ROOT.File.Inclusion
Description
This indicates a vulnerability in Online Fantasy Football League (OFFL). This vulnerability is caused the failure to validate the "DOC_ROOT" parameter in the "lib/functions.php" and "lib/header.php" scripts. It allows remote attackers to include malicious PHP scripts and execute arbitrary commands.
Affected Products
OFFL OFFL 0.2.6
OFFL OFFL 0.2.3
Impact
System compromise, remote script execution.
Recommended Actions
Currently we are not aware of any official fix for this issue.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 15092 |
| Created | Oct 19, 2007 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2007-4809 |
| Exploit Prediction Score | 11.75% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, BSD, Solaris, MacOS |
| Affected App | PHP_app |