PT-2003-1483 · Yabb · Yabb Se

Dalibor Karlovic + 1 · Publicado 2003-05-14 · Atualizado 2016-10-18 · CVE-2003-0275

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: YaBB SE version 1.5.2

Description: The issue allows remote attackers to execute arbitrary PHP code. This is achieved by modifying the sourcedir parameter to reference a URL on a remote web server that contains the malicious code.

Recommendations: For YaBB SE version 1.5.2, avoid using the sourcedir parameter to reference external URLs until a patch is available. As a temporary workaround, consider restricting access to the SSI.php file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2003-0275

Produtos afetados

Yabb Se

Referências · 2

• http://marc.info/?l=bugtraq&m=105249980809988&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-0275 · Nota de Segurança