Description
PHP remote file inclusion vulnerability in start.php in Bitrix Site Manager 4.0.x allows remote attackers to execute arbitrary PHP code via the _SERVER[DOCUMENT_ROOT] parameter.
References
- bitrix-serverdocumentroot-file-include(21018) vdb-entry
- http://www.bitrixsoft.com/sitemanager/versions.php?module=main
- 20050615 Vulnerability: Bitrix Php inclusion mailing-list
- 15726 third-party-advisory
- 13965 vdb-entry
- ADV-2005-0779 vdb-entry
- http://www.bitrixsoft.com/support/forum/read.php?FID=10&TID=1872
- 17341 vdb-entry