Adem "p" Arbitrary File Inclusion Vulnerability


Description   A vulnerability has been discovered in Adem, which can be exploited by malicious people to compromise a vulnerable system.
Input passed via the "p" GET parameter to index.php is not properly verified before being used to include files. This can be exploited to execute arbitrary PHP code by including files from local or remote resources.
The vulnerability is confirmed in version 0.5.1. Other versions may also be affected.
     
Vulnerable Products   Vulnerable Software:
Adem 0.x
     
Solution   No official solution is currently available.
     
CVE  
     
References   http://www.exploit-db.com/exploits/33072/
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL
3.2.0
PHP : Remote file inclusion prevention : URL found as parameter
3.2.0
Misc : Local File Inclusion - suspicious /etc/passwd found in URL
3.5.0
     


 
 
 
 
 Risk level 
High 

 Vulnerability First Public Report Date 
2014-04-30 

 Target Type 
Server 

 Possible exploit 
Remote