Tenrok Command Injection and Information Disclosure Vulnerabilities
Description
Two vulnerabilities have been identified in Tenrok, which could be exploited by remote attackers to disclose sensitive information or compromise a vulnerable web server.
The first issue is caused by an input validation error in the "post.php" script when processing user-supplied parameters (e.g. "title"), which could be exploited by remote attackers to write arbitrary data to a PHP file and execute commands with the privileges of the web server.
The second vulnerability is caused due to the "userpwd.txt" file being created in the webroot directory, which could allow attackers to gain knowledge of login credentials.
Vulnerable Products
Vulnerable Software: Tenrok version 1.1.0 and prior
