Directory traversal vulnerability in includes/block.php in Agares Media phpAutoVideo 2.21 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the selected_provider parameter.
Agares Media phpAutoVideo is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input.Exploiting these issues will allow an attacker to access potentially sensitive information and execute arbitrary scripts or PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.These issues affect phpAutoVideo 2.21; other versions may also be affected.
The vendor released phpAutoVideo 2.22 to address this issue. Please see the references for further information. Agares Media phpAutoVideo 2.21 Cuyahoga phpAutoVideo_2.22_UPGRADE_from_2.21.zip http://updates.agaresmedia.com/phpAutoVideo_2.22_UPGRADE_from_2.21.zip
Attackers may exploit these issues through a browser.The following proof-of-concept URIs are available:http://www.example.com/includes/block.php?selected_provider=[LFI]%00http://www.example.com/admin/frontpage_right.php?loadadminpage=[Evil_Code]