Mapserver for Windows (MS4W) is prone to an local file include vulnerability because it fails to sufficiently sanitize user supplied input. An attacker can exploit this vulnerability to view files and execute arbitrary local PHP scripts with the privileges of the affected application. Mapserver for Windows versions 2.0 through 3.0.4 are vulnerable.

Updates are available. Please contact the vendor for more information.

• http://maptools.org/ms4w/index.phtml?page=home.html
• http://www.securityfocus.com/archive/1/522908
• http://www.securityfocus.com/bid/53737

---

Updated on 2015-03-25