Double Choco Latte 0.9.3/0.9.4 - 'main.php' Arbitrary PHP Code Execution

Author: GulfTech Security
type: webapps
platform: php
port: 0
date_added: 2005-03-24
date_updated: 2018-01-05
verified: 1
codes: CVE-2005-0887;OSVDB-14954;BID: 12894;GTSA-00062
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/12894/info

Double Choco Latte is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting/HTML injection attacks and execute arbitrary PHP code on a computer.

Double Choco Latte 0.9.4.3 is reported vulnerable to the cross-site scripting/HTML injection issue.

Double Choco Latte 0.9.4.2 and prior versions are affected by the PHP code execution issue.

This BID will be updated when more information is available.

http://www.example.com/main.php?menuAction=htmlTickets.show;system(id);ob_start