Description
Direct static code injection vulnerability in add_link.txt in daverave Link Bank allows remote attackers to execute arbitrary PHP code via the url_name parameter, which is not sanitized before being stored in links.txt, which is later used in an include statement.
References
- 19154 third-party-advisory
- 553 third-party-advisory
- 23750 vdb-entry
- 17004 vdb-entry
- 20060306 link bank code execution and xss mailing-list
- ADV-2006-0885 vdb-entry