PT-2007-2067 · Unknown · Advanced Guestbook

Publicado 2007-05-09 · Atualizado 2018-10-16 · CVE-2007-0609

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Advanced Guestbook version 2.4.2

Description The issue allows remote attackers to bypass .htaccess settings and execute arbitrary PHP local files or read arbitrary local templates. This is achieved by sending a request to index.php with a lang cookie containing a .. (dot dot) followed by a filename without its .php extension.

Recommendations For Advanced Guestbook version 2.4.2, consider restricting access to the lang cookie to prevent manipulation, and ensure that .htaccess settings are properly configured to prevent directory traversal attacks. As a temporary workaround, consider disabling the execution of arbitrary PHP files until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-0609

Produtos afetados

Advanced Guestbook

Referências · 12

• 🔥 http://securityfocus.com/bid/23876 · Exploit
• 🔥 https://exploit-db.com/exploits/30015 · Exploit
• http://netvigilance.com/advisory0013 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0609 · Nota
• http://secunia.com/advisories/25153 · Aviso do Fabricante
• http://securityfocus.com/archive/1/467941/100/0/threaded · Nota
• http://netvigilance.com/advisory0012 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1726 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34152 · Nota
• http://securityfocus.com/archive/1/467937/100/0/threaded · Nota
• http://securityreason.com/securityalert/2662 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0609 · Nota de Segurança