PT-2014-85: Local File Inclusion in ShopOS Vulnerable softwareShopOS Version: 2.5.9 and earlierLink: http://www.shopos.ru/Severity levelSeverity level: High Impact: Local File Inclusion Access Vector: Remote CVSS v2: Base Score: 7.5 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)CVE: not assignedSoftware descriptionShopOS is a web content management system.Vulnerability descriptionThe specialists of the Positive Research center have detected a Local File Inclusion vulnerability in ShopOS.Insufficient validation of user input in the 3.php script allows remote attackers to include files located on the attacked server and thus execute a PHP code. It may result in sensitive data disclosure, obtaining of application source code, configuration files, server compromising, etc.How to fix No solution.Advisory status 26.12.2013 - Vendor gets vulnerability details 29.12.2014 - Public disclosureCreditsThe vulnerability was detected by using Positive Technologies Application Inspector, the application security testing systemReferenceshttp://en.securitylab.ru/lab/PT-2014-85 Reports on the vulnerabilities previously discovered by Positive Research:http://www.ptsecurity.com/research/advisory/ http://en.securitylab.ru/lab/
