PT-2005-1778 · Xoops · Xoops

Publicado 2005-03-13 · Atualizado 2017-07-11 · CVE-2005-0743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XOOPS versions 2.0.9.2 and earlier

Description The issue concerns the custom avatar uploading feature, specifically the uploader.php file, which does not filter file extensions. This allows remote attackers to upload arbitrary PHP scripts.

Recommendations For XOOPS versions 2.0.9.2 and earlier, consider disabling the custom avatar uploading feature, specifically the uploader.php file, until a fix is available to prevent the upload of arbitrary PHP scripts.

Correção

Identificadores relacionados

CVE-2005-0743

Produtos afetados

Xoops

Referências · 7

• http://xoops.org/modules/news/article.php?storyid=2114 · Correção
• http://securityfocus.com/archive/1/392626 · Correção
• http://secunia.com/advisories/14520 · Aviso do Fabricante
• http://securityfocus.com/bid/12754 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0743 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19634 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0743 · Nota de Segurança