PT-2007-1806 · Jax · Jax Petition Book

Publicado 2007-01-18 · Atualizado 2018-10-16 · CVE-2007-0335

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jax Petition Book version 1.0.3.06

Description: The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the languagepack parameter to API endpoints such as "jax petitionbook.php" or "smileys.php".

Recommendations: For Jax Petition Book version 1.0.3.06, consider restricting access to the languagepack parameter in the affected API endpoints "jax petitionbook.php" and "smileys.php" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2007-0335

Produtos afetados

Jax Petition Book

Referências · 13

• 🔥 https://exploit-db.com/exploits/29468 · Exploit
• 🔥 https://exploit-db.com/exploits/29469 · Exploit
• http://vupen.com/english/advisories/2007/0220 · Nota
• http://secunia.com/advisories/23784 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0335 · Nota de Segurança
• http://securityfocus.com/bid/22072 · Nota
• http://securityfocus.com/archive/1/457077/100/0/threaded · Nota
• http://osvdb.org/32835 · Nota
• http://securityreason.com/securityalert/2161 · Nota
• http://securityfocus.com/archive/1/456981/100/0/threaded · Nota
• http://osvdb.org/32836 · Nota
• http://securityfocus.com/archive/1/456989/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31543 · Nota