PT-2005-3662 · Fudforum · Fudforum

Riklaunim · Publicado 2005-09-02 · Atualizado 2018-10-19 · CVE-2005-2781

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FUD Forum versions prior to 2.7.0

Description The issue concerns the Avatar upload feature, which fails to properly verify uploaded files. This allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension that contains image data followed by PHP code.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 or later to resolve the issue. As a temporary workaround, consider disabling the Avatar upload feature until a patch is available. Restrict access to the upload module to minimize the risk of exploitation. Avoid using the Avatar upload feature in the affected versions until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-2781

DSA-1063-1

Produtos afetados

Fudforum

Referências · 9

• http://securityfocus.com/archive/1/500406/100/0/threaded · Nota
• http://debian.org/security/2006/dsa-1063 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2781 · Nota de Segurança
• http://secunia.com/advisories/16627 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22076 · Nota
• http://secunia.com/advisories/20203 · Nota
• http://marc.info/?l=bugtraq&m=112534235403406&w=2 · Nota
• http://securityfocus.com/bid/14678 · Nota
• http://fudforum.org/forum/index.php?t=msg&th=5470&start=0& · Nota