PT-2003-1182 · Achievo · Achievo

Publicado 2003-04-11 · Atualizado 2008-09-05 · CVE-2002-1435

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Achievo versions 0.7.0 through 0.9.1, except version 0.8.2

Description The issue allows remote attackers to execute arbitrary PHP code when the 'allow url fopen' setting is enabled. This is achieved via a URL in the config atkroot parameter that points to the code.

Recommendations For Achievo versions 0.7.0 through 0.9.1, except version 0.8.2, consider disabling the allow url fopen setting to prevent exploitation. Additionally, restrict access to the config atkroot parameter to minimize the risk of arbitrary PHP code execution.

Exploit

Correção

Identificadores relacionados

CVE-2002-1435

Produtos afetados

Achievo

Referências · 6

• 🔥 https://exploit-db.com/exploits/21745 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-08/0235.html · Exploit
• 🔥 http://securityfocus.com/bid/5552 · Exploit
• http://achievo.org/lists/2002/Aug/msg00092.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1435 · Nota de Segurança
• http://iss.net/security_center/static/9947.php · Aviso do Fabricante