Description
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary PHP code via the abs_path parameter in (1) initiate.php, (2) waiting.php, (3) welcome.php, (4) admin/index.php, (5) javascript.php, (6) checkchat.php, and (7) blank.php.
References
- 24199 vdb-entry
- 20060619 Re: PHP Live Helper <=([abs_path]) Remote File Include Vulnerabilities mailing-list
- 24194 vdb-entry
- 24193 vdb-entry
- 20060327 PHPLiveHelper 1.8 remote command execution (include) Xploit (perl) mailing-list
- 24195 vdb-entry
- 19428 third-party-advisory
- ADV-2006-1137 vdb-entry
- 20060619 PHP Live Helper <=([abs_path]) Remote File Include Vulnerabilities mailing-list
- 24198 vdb-entry
- 24197 vdb-entry
- http://www.turnkeywebtools.com/forum/showthread.php?p=10415
- phplivehelper-abspath-file-include(25489) vdb-entry
- http://www.worlddefacers.de/Public/WD-TMPLH.txt
- 24196 vdb-entry
- 18509 vdb-entry