PT-2003-2357 · Gonicus · Gonicus System Administrator

Publicado 2003-12-31 · Atualizado 2018-10-19 · CVE-2003-1412

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GONiCUS System Administrator (GOsa) version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via the plugin parameter to various PHP files, including 3fax/1blocklists/index.php, 6departamentadmin/index.php, 5terminals/index.php, 4mailinglists/index.php, 3departaments/index.php, and 2groupd/index.php in the 2administration/ directory, or the base parameter to include/help.php.

Recommendations For GONiCUS System Administrator (GOsa) version 1.0, consider restricting access to the vulnerable plugin and base parameters in the affected PHP files until a patch is available. As a temporary workaround, disabling the execution of arbitrary PHP code via these parameters can help minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2003-1412

Produtos afetados

Gonicus System Administrator

Referências · 8

• 🔥 https://exploit-db.com/exploits/22279 · Exploit
• 🔥 http://securityfocus.com/bid/6922 · Exploit
• http://secunia.com/advisories/8120 · Nota
• http://securityfocus.com/archive/1/313282/30/25760/threaded · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2003-February/003932.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1412 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11408 · Nota
• http://securitytracker.com/id?1006162 · Nota