PT-2005-3572 · Savewebportal · Savewebportal

Publicado 2005-08-24 · Atualizado 2008-09-05 · CVE-2005-2686

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SaveWebPortal version 3.4

Description A directory traversal issue allows remote attackers to include arbitrary files and execute arbitrary local PHP programs. This is achieved by using ".." sequences in the SITE Path parameter to "menu dx.php" or the CONTENTS Dir parameter to "menu sx.php".

Recommendations For SaveWebPortal version 3.4, as a temporary workaround, consider restricting access to the menu dx.php and menu sx.php API endpoints until a patch is available. Avoid using the SITE Path and CONTENTS Dir parameters in these endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2005-2686

Produtos afetados

Savewebportal

Referências · 3

• 🔥 http://rgod.altervista.org/save_yourself_from_savewebportal34.html · Exploit
• 🔥 http://secunia.com/advisories/16522 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2686 · Nota de Segurança