PT-2007-2668 · Awebnews · Awebnews

Mostafa_Ragab + 1 · Publicado 2007-03-03 · Atualizado 2018-10-16 · CVE-2007-1247

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aWebNews version 1.5

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the path to news parameter to specific PHP files, including "listing.php" and "visview.php" API endpoints.

Recommendations For aWebNews version 1.5, consider restricting access to the listing.php and visview.php files until a patch is available, and avoid using the path to news parameter in these API endpoints to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-1247

Produtos afetados

Awebnews

Referências · 11

• 🔥 https://exploit-db.com/exploits/29696 · Exploit
• 🔥 http://securityfocus.com/bid/22781 · Exploit
• http://securityreason.com/securityalert/2365 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32770 · Nota
• http://secunia.com/advisories/24351 · Aviso do Fabricante
• http://osvdb.org/33824 · Nota
• http://securityfocus.com/archive/1/461684/100/0/threaded · Nota
• http://securityfocus.com/archive/1/461680/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/0808 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1247 · Nota de Segurança
• http://osvdb.org/33825 · Nota