A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system.
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
| Link | Tags |
|---|---|
| https://www.exploit-db.com/exploits/43388/ | third party advisory vdb entry exploit |
| http://www.securityfocus.com/bid/102275 | third party advisory vdb entry |
| https://success.trendmicro.com/solution/1118992 | vendor advisory |
| https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities | third party advisory exploit |