Description
Eval injection vulnerability in environment.php in Olate Download (od) 3.4.1 allows context-dependent attackers to execute arbitrary code via a crafted version string, as referenced by the (1) PDO::ATTR_SERVER_VERSION or (2) PDO::ATTR_CLIENT_VERSION attribute.
References
- 3038 third-party-advisory
- http://myimei.com/security/2007-08-17/olate-download-341-environmentphpphp-code-execution.html
- olate-environment-code-execution(36087) vdb-entry
- http://sourceforge.net/project/shownotes.php?group_id=188052&release_id=533628
- 25356 vdb-entry
- 20070817 Olate Download 3.4.1~environment.php.php~Code Execution mailing-list
- 20070821 Re: Olate Download 3.4.1 ~ admin.php ~ Admin authentication bypassing mailing-list