PT-2007-2407 · Artisan Ui · Jupiter Cms

Darkfig · Publicado 2007-02-16 · Atualizado 2018-10-16 · CVE-2007-0972

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Jupiter CMS version 1.1.5

Description: The issue is related to an unrestricted file upload vulnerability. This allows remote attackers to upload arbitrary files by modifying the HTTP request, specifically by sending an image content type and omitting certain parameters, such as is guest and is user.

Recommendations: For Jupiter CMS version 1.1.5, consider restricting access to the modules/emoticons.php file to prevent arbitrary file uploads until a patch is available. As a temporary workaround, modify the HTTP request handling to validate and enforce the presence of required parameters, such as is guest and is user, and to properly check the content type of uploaded files.

Exploit

Correção

Identificadores relacionados

CVE-2007-0972

Produtos afetados

Jupiter Cms

Referências · 9

• 🔥 https://exploit-db.com/exploits/3311 · Exploit
• 🔥 http://securityfocus.com/bid/22560 · Exploit
• http://osvdb.org/33728 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0972 · Nota de Segurança
• http://mgsdl.free.fr/advisories/12070214.txt · Aviso do Fabricante
• http://acid-root.new.fr/advisories/12070214.txt · Aviso do Fabricante
• http://securityfocus.com/archive/1/460076/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32517 · Nota
• http://securityfocus.com/archive/1/460100/100/0/threaded · Nota