high7.5Public exploit code
CVE-2008-0390
stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AuraCMS 1.62 - 'stat.php' Remote Code Execution2008-01-18 · webapps · php · Verified
Impact
stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Auracms | Auracms | Version 1.62 |
| Auracms | Mod Block Statistik | All versions |