VULHUB ™

phpSecurePages is a PHP module to secures pages with a login name and password. An input validation error exists that could enable remote users to cause the 'interface.php' script used by phpSecurePages to be loaded from an arbitrary location. The problem occurs when the 'cfgProgPath' variable is submitted as part of query element is submitted as part of a request. As a result, it is possible for a remote user to specify the URL of a site containing a malicious 'interface.php' file as the 'cfgProgPath' variable. This will cause any code in the file to be executed by the checklogin.php script on the site running phpSecurePages, with the privileges of the webserver.

phpSecurePages is a PHP module to secures pages with a login name and password. An input validation error exists that could enable remote users to cause the 'interface.php' script used by phpSecurePages to be loaded from an arbitrary location. The problem occurs when the 'cfgProgPath' variable is submitted as part of query element is submitted as part of a request. As a result, it is possible for a remote user to specify the URL of a site containing a malicious 'interface.php' file as the 'cfgProgPath' variable. This will cause any code in the file to be executed by the checklogin.php script on the site running phpSecurePages, with the privileges of the webserver.