Intrusion PreventionNcasterCMS.Archive.PHP.File.Inclusion
Description
Ncaster has a remote file inclusion vulnerability. A remote attacker could execute arbitrary scripts on a web server with the privileges of the server via a specially-crafted URL request to the 'admin/addons/archive/archive.php' script, by using the 'adminfolder' parameter to specify a malicious PHP file from a remote system.
Affected Products
Ncaster version 1.7.2 and prior.
Impact
System compromise, remote script execution.
Recommended Actions
Currently we are not aware of any official fix for this issue.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 14950 |
| Created | Sep 07, 2007 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2007-4320 |
| Exploit Prediction Score | 15.77% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, BSD, Solaris, MacOS |
| Affected App | PHP_app |