PT-2005-3663 · Unknown · Autolinks Pro

4Degrees · Publicado 2005-09-02 · Atualizado 2017-07-11 · CVE-2005-2782

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AutoLinks Pro version 2.1

Description The issue allows remote attackers to execute arbitrary PHP code via an "ftp://" URL in the alpath parameter. This is possible because the blacklist only checks for "http" and "https" URLs, allowing other types of URLs to bypass the check.

Recommendations For AutoLinks Pro version 2.1, consider restricting access to the al initialize.php file or the alpath parameter to minimize the risk of exploitation until a proper fix is available. Avoid using the alpath parameter with untrusted input.

Exploit

Correção

Identificadores relacionados

CVE-2005-2782

Produtos afetados

Autolinks Pro

Referências · 6

• 🔥 http://securityfocus.com/bid/14686 · Exploit
• 🔥 https://exploit-db.com/exploits/26208 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22061 · Nota
• http://secunia.com/advisories/16620 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=112535379716486&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-2782 · Nota de Segurança