PT-2003-2330 · Invision · Invision Power Board

Publicado 2003-12-31 · Atualizado 2017-07-29 · CVE-2003-1385

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Invision Power Board version 1.1.1

Description The issue allows remote attackers to execute arbitrary PHP code if register globals is enabled. This is achieved by modifying the root path parameter to reference a URL on a remote web server that contains the code.

Recommendations For Invision Power Board version 1.1.1, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the ipchat.php file until a patch is available. Avoid using the root path parameter in the affected file until the issue is resolved.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2003-1385

Produtos afetados

Invision Power Board

Referências · 8

• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0099.html · Exploit
• 🔥 https://exploit-db.com/exploits/22295 · Exploit
• http://osvdb.org/3357 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1385 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1385 · Nota
• http://securityfocus.com/bid/6976 · Nota
• http://secunia.com/advisories/8182 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11435 · Nota