PT-2005-3525 · Phpadsnew · Phppgads+1

Maksymilian Arciemowicz · Publicado 2005-08-20 · Atualizado 2017-07-11 · CVE-2005-2635

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpAdsNew versions prior to 2.0.6 phpPgAds versions prior to 2.0.6

Description The issue allows remote attackers to include arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the layerstyle parameter to "adlayer.php" or the language parameter to "js-form.php".

Recommendations For phpAdsNew versions prior to 2.0.6, update to version 2.0.6 or later. For phpPgAds versions prior to 2.0.6, update to version 2.0.6 or later. As a temporary workaround, consider restricting access to the "adlayer.php" and "js-form.php" files until a patch is available. Avoid using the layerstyle and language parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-2635

Produtos afetados

Phpadsnew

Phppgads

Referências · 7

• 🔥 http://securityreason.com/adv/phpAdsnew.SR.16.asc · Exploit
• http://securityfocus.com/bid/14584 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2635 · Nota
• http://secunia.com/advisories/16469 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2635 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112431497300344&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21880 · Nota