PT-2003-1831 · Phpwebsite · Phpwebsite

Lorenzo Hernandez Garcia-Hierro

·

Publicado

2003-09-04

·

Atualizado

2016-10-18

·

CVE-2003-0736

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: phpWebSite versions 0.9.x and earlier
Description: The issue allows remote attackers to execute arbitrary web script. This can be achieved via several parameters, including the day parameter in the "calendar" module, the fatcat id parameter in the "fatcat" module, the PAGE id parameter in the "pagemaster" module, and the PDA limit parameter in the "search" module. Other parameters in the "calendar", "fatcat", and "pagemaster" modules may also be vulnerable.
Recommendations: For phpWebSite versions 0.9.x and earlier, consider disabling the calendar, fatcat, and pagemaster modules until a patch is available. Restrict access to the search module to minimize the risk of exploitation. Avoid using the parameters day, fatcat id, PAGE id, and PDA limit in their respective modules until the issue is resolved.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2003-0736

Produtos afetados

Phpwebsite