PT-2004-1319 · Phpgedview · Phpgedview

Publicado 2004-03-03 · Atualizado 2017-10-10 · CVE-2004-0128

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpGedView versions 2.65.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code by modifying the PGV BASE DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script. This enables attackers to execute malicious code on the server.

Recommendations For phpGedView versions 2.65.1 and earlier, consider restricting access to the GEDCOM configuration script until a fix is available. As a temporary workaround, avoid using the PGV BASE DIRECTORY parameter to reference external URLs.

Exploit

Correção

Identificadores relacionados

CVE-2004-0128

Produtos afetados

Phpgedview

Referências · 8

• 🔥 http://securityfocus.com/bid/9531 · Exploit
• 🔥 http://securityfocus.com/archive/1/352355 · Exploit
• 🔥 https://exploit-db.com/exploits/23617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0128 · Nota de Segurança
• http://secunia.com/advisories/10753 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=141517 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/14987 · Nota
• http://osvdb.org/3769 · Nota