PT-2005-4315 · Mysource · Mysource

Publicado 2005-11-06 · Atualizado 2017-07-11 · CVE-2005-3519

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySource version 2.14.0

Description The issue allows remote attackers to execute arbitrary PHP code and include arbitrary local files. This is achieved through multiple PHP file inclusion vulnerabilities via the INCLUDE PATH and SQUIZLIB PATH parameters in new upgrade functions.php, the INCLUDE PATH parameter in init mysource.php, and the PEAR PATH parameter in various PHP files, including Socket.php, Request.php, Mail.php, Date.php, Span.php, mimeDecode.php, and mime.php.

Recommendations For MySource version 2.14.0, consider restricting access to the vulnerable parameters INCLUDE PATH, SQUIZLIB PATH, and PEAR PATH until a patch is available. As a temporary workaround, avoid using these parameters in the affected PHP files.

Exploit

Correção

Identificadores relacionados

CVE-2005-3519

Produtos afetados

Mysource

Referências · 26

• 🔥 https://exploit-db.com/exploits/26364 · Exploit
• 🔥 http://securitytracker.com/id?1015075 · Exploit
• 🔥 http://secunia.com/advisories/16946 · Exploit
• 🔥 https://exploit-db.com/exploits/26371 · Exploit
• 🔥 https://exploit-db.com/exploits/26370 · Exploit
• 🔥 https://exploit-db.com/exploits/26365 · Exploit
• 🔥 https://exploit-db.com/exploits/26362 · Exploit
• 🔥 https://exploit-db.com/exploits/26363 · Exploit
• 🔥 https://exploit-db.com/exploits/26373 · Exploit
• 🔥 https://exploit-db.com/exploits/26369 · Exploit
• 🔥 https://exploit-db.com/exploits/26372 · Exploit
• 🔥 http://securityfocus.com/bid/15133/discuss · Exploit
• http://osvdb.org/20042 · Nota
• http://osvdb.org/20039 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22772 · Nota