PT-2007-2786 · Netforo! · Netforo!

Gold_M · Publicado 2007-03-10 · Atualizado 2017-10-11 · CVE-2007-1392

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions netForo! version 0.1g

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the down.php file. This is achieved by using a .. (dot dot) in the file to download parameter.

Recommendations For netForo! version 0.1g, restrict access to the down.php file to minimize the risk of exploitation. Avoid using the file to download parameter with unvalidated input until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-1392

Produtos afetados

Netforo!

Referências · 6

• 🔥 http://securityfocus.com/bid/22875 · Exploit
• 🔥 https://exploit-db.com/exploits/3435 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32878 · Nota
• http://vupen.com/english/advisories/2007/0884 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1392 · Nota de Segurança
• http://secunia.com/advisories/24449 · Nota