CVE-2009-4541 Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) newticket.php or (2) rempa...
HighCVSS 7.5
EPSS 7.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) newticket.php or (2) rempass.php, or a URL in the lang parameter in an adduser action to (3) index.php. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isolsoft support center | = 2.5 | No fix listed |
References
- 56869 vdb-entry
- 56870 vdb-entry
- 56871 vdb-entry
- 36208 third-party-advisory vendor-advisory
- 9397 exploit
- 35997 exploit vdb-entry
- supportcenter-lang-file-include(52350) vdb-entry
- supportcenter-index-file-include(52352) vdb-entry