CVE-2004-0285 PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMV...
CriticalCVSS 9.8
EPSS 7.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| allmyguests project allmyguests | = 0.1.2 | No fix listed |
| allmyguests project allmyguests | = 0.3 | No fix listed |
| allmyguests project allmyguests | = 0.4 | No fix listed |
| allmyguests project allmyguests | = 0.4.1 | No fix listed |
| allmylinks project allmylinks | = 0.3 | No fix listed |
| allmylinks project allmylinks | = 0.4 | No fix listed |
| allmylinks project allmylinks | = 0.4.1 | No fix listed |
| allmylinks project allmylinks | = 0.4.3 | No fix listed |
| allmylinks project allmylinks | = 0.4.4 | No fix listed |
| allmylinks project allmylinks | = 0.4.9 | No fix listed |
| allmylinks project allmylinks | = 0.5 | No fix listed |
| allmyvisitors project allmyvisitors | = 0.3 | No fix listed |
| allmyvisitors project allmyvisitors | = 0.4 | No fix listed |
References
- 20040214 AllMyGuests PHP Code Injection vulnerability mailing-list third-party-advisory
- 20040214 AllMyVisitors PHP Code Injection vulnerability mailing-list third-party-advisory
- 20040214 AllMyLinks PHP Code Injection vulnerability mailing-list third-party-advisory
- 6721 broken-link vdb-entry
- 9664 broken-link exploit patch third-party-advisory vdb-entry vendor-advisory
- allmylinks-file-include(15226) third-party-advisory vdb-entry
- allmyguests-php-file-include(15227) third-party-advisory vdb-entry
- allmyvisitors-file-include(15228) third-party-advisory vdb-entry