PT-2005-3847 · Cutenews · Cutenews

Rgod · Publicado 2005-09-21 · Atualizado 2008-09-05 · CVE-2005-3010

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews versions 1.4.0 and earlier

Description A direct static code injection issue exists in the flood protection feature of CuteNews, allowing remote attackers to execute arbitrary PHP code. This is achieved by injecting malicious code via the HTTP CLIENT IP header, which is then inserted into data/flood.db.php.

Recommendations For CuteNews versions 1.4.0 and earlier, consider disabling the flood protection feature in inc/shows.inc.php until a patch is available to prevent exploitation. Restrict access to data/flood.db.php to minimize the risk of arbitrary PHP code execution. Avoid using the HTTP CLIENT IP header in the affected feature until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-3010

Produtos afetados

Cutenews

Referências · 5

• 🔥 http://securityfocus.com/bid/14869 · Exploit
• 🔥 http://securityfocus.com/archive/1/411057 · Exploit
• 🔥 https://exploit-db.com/exploits/1221 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-3010 · Nota de Segurança
• http://securityreason.com/securityalert/14 · Nota