PT-2007-2579 · Unknown · Pyrophobia

Publicado 2007-02-27 · Atualizado 2017-10-11 · CVE-2007-1152

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyrophobia version 2.1.3.1

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the act or pid parameter to the "index.php" endpoint, or the action parameter to "admin/index.php".

Recommendations For Pyrophobia version 2.1.3.1, as a temporary workaround, consider restricting access to the act, pid, and action parameters in the affected endpoints until a patch is available. Avoid using the act and pid parameters in the top-level "index.php" endpoint and the action parameter in "admin/index.php" to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-1152

Produtos afetados

Pyrophobia

Referências · 6

• 🔥 https://exploit-db.com/exploits/8095 · Exploit
• 🔥 https://exploit-db.com/exploits/29632 · Exploit
• 🔥 http://securityfocus.com/bid/22667 · Exploit
• http://osvdb.org/37398 · Nota
• http://securityfocus.com/bid/33861 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1152 · Nota de Segurança