PT-2002-1755 · B2 · B2

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0734

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions B2 versions 2.0.6pre2 and earlier

Description The issue arises from the improper loading of the b2config.php file in certain configurations by the b2edit.showposts.php script. This allows remote attackers to execute arbitrary PHP code by manipulating the $b2inc variable to point to a malicious program stored on a remote server.

Recommendations For B2 versions 2.0.6pre2 and earlier, ensure the b2config.php file is properly loaded and secured to prevent remote attackers from manipulating the $b2inc variable. Consider restricting access to the b2edit.showposts.php script until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-0734

Produtos afetados

B2

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-05/0027.html · Exploit
• 🔥 https://exploit-db.com/exploits/21436 · Exploit
• 🔥 http://securityfocus.com/bid/4673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0734 · Nota de Segurança
• http://iss.net/security_center/static/9013.php · Aviso do Fabricante
• http://cafelog.com · Aviso do Fabricante