Attack vector NETWORK
Attack complexity LOW
Privileges required NONE
Confidentiality impact PARTIAL
Integrity impact PARTIAL
Availability impact PARTIAL
Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability when the administrator has not followed installation instructions in install.php. NOTE: this might be the same as CVE-2020-35598.
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files
- Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
|description||Advanced Comment System 1.0 Multiple RFI Vulnerabilities. CVE-2009-4623. Webapps exploit for php platform|
|title||Advanced Comment System 1.0 - Multiple RFI Vulnerabilities|