PT-2004-1279 · Phpdig · Phpdig

Frame · Publicado 2004-02-17 · Atualizado 2017-10-10 · CVE-2004-0068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PhpDig versions 1.6.5 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code by modifying the relative script path parameter to reference a URL on a remote web server that contains the code. This can be done through the config.php file.

Recommendations For PhpDig versions 1.6.5 and earlier, as a temporary workaround, consider restricting access to the config.php file and avoid using the relative script path parameter to reference external URLs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-0068

Produtos afetados

Phpdig

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/14826 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0068 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=107412194008671&w=2 · Nota
• http://phpdig.net/showthread.php?s=58bcc71c822830ec3bbdaae6d56846e0&threadid=393 · Correção
• http://securityfocus.com/bid/9424 · Aviso do Fabricante