PT-2002-2766 · X-Stat · X-Stat

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-2045

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions x-stat versions 2.3 and earlier

Description The issue allows remote attackers to execute PHP commands, such as phpinfo, or obtain the full path of the web server. This is achieved via an invalid action parameter, which leaks the pathname in an error message.

Recommendations For versions 2.3 and earlier, consider restricting access to the x stat admin.php file until a patch is available. As a temporary workaround, avoid using invalid action parameters in the x stat admin.php file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2002-2045

Produtos afetados

X-Stat

Referências · 8

• 🔥 http://securitytracker.com/id?1003827 · Exploit
• http://ifrance.com/kitetoua/tuto/x_holes.txt · Aviso do Fabricante
• http://seclists.org/lists/vuln-dev/2002/Mar/0156.html · Nota
• http://securityfocus.com/bid/4280 · Nota
• http://securityfocus.com/bid/4279 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8467 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8466 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-2045 · Nota de Segurança