PT-2007-1781 · Php · Php-Nuke

Paisterist · Publicado 2007-01-18 · Atualizado 2018-10-16 · CVE-2007-0309

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Nuke versions 7.9 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This is possible when register globals is enabled and magic quotes gpc is disabled. The cat parameter is used for this purpose.

Recommendations: For PHP-Nuke versions 7.9 and earlier, consider disabling the register globals setting and enabling magic quotes gpc to prevent exploitation. Additionally, restrict access to the blocks/block-Old Articles.php file until a fix is available. Avoid using the cat parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-0309

Produtos afetados

Php-Nuke

Referências · 11

• 🔥 http://securityfocus.com/bid/22037 · Exploit
• 🔥 https://exploit-db.com/exploits/29453 · Exploit
• http://securityfocus.com/archive/1/456787/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31482 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0309 · Nota
• http://secunia.com/advisories/23748 · Nota
• http://securityreason.com/securityalert/2153 · Nota
• http://osvdb.org/32863 · Nota
• http://neosecurityteam.net/advisories/PHP-Nuke--7.9-Old-Articles-Block-cat-SQL-Injection-vulnerability-31.html · Nota
• http://securitytracker.com/id?1017511 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0309 · Nota de Segurança