Description
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) path_red2 parameter to (a) _msdazu_pdata/redaktion/artikel/up/index.php; (b) addtort.php, (c) colorpik2.php, (d) colorpik3.php, (e) extras_menu.php, (f) farbpalette.php, (g) lese_inc.php, and (h) newfile.php in _msdazu_share/richtext/; the (2) path_scr_dat2 parameter to (i)_msdazu_share/share/insert1.php; the (3) path_red parameter to (j) _msdazu_share/extras/downloads/index.php; and unspecified parameters in other files.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions EDB-2611 · webapps · Oct 21, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 29963 vdb-entry
- 29968 vdb-entry
- 29964 vdb-entry
- 29960 vdb-entry
- 20678 vdb-entry
- 22525 third-party-advisory
- 2611 exploit
- 1017111 vdb-entry
- 29961 vdb-entry
- 29966 vdb-entry
- http://cmsblog.msdazu.de/?p=209
- 29969 vdb-entry
- trawler-pathred-file-include(29715) vdb-entry
- 29962 vdb-entry
- ADV-2006-4152 vdb-entry
- 20662 vdb-entry
- 29965 vdb-entry
- 20061021 trawler <= 1.8.1 Remote File Inclusion mailing-list
- 29967 vdb-entry