PT-2007-2057 · Aztek · Aztek Forum

Publicado 2007-01-30 · Atualizado 2018-10-16 · CVE-2007-0599

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Aztek Forum version 4.00

Description The issue allows remote attackers to overwrite arbitrary program variables, which can lead to unauthorized activities. This can be achieved through vectors associated with extract operations on the POST, GET, COOKIE, and SERVER superglobal arrays, enabling actions such as copying arbitrary files using index/common actions.php.

Recommendations For Aztek Forum version 4.00, consider restricting access to the common/config.php file and limiting the use of extract operations on superglobal arrays to minimize the risk of exploitation. As a temporary workaround, avoid using the extract() function on user-input data until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-0599

Produtos afetados

Aztek Forum

Referências · 5

• 🔥 http://acid-root.new.fr/poc/21070125.txt · Exploit
• http://securityfocus.com/archive/1/458076/100/0/threaded · Nota
• http://securityfocus.com/archive/1/458123/100/0/threaded · Nota
• http://osvdb.org/33596 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0599 · Nota de Segurança