PT-2007-2845 · Guppy · Guppy

Publicado 2007-03-14 · Atualizado 2018-10-16 · CVE-2007-1451

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GuppY version 4.0

Description The issue allows remote attackers to delete arbitrary files. This can be achieved by making a direct request to the install/install.php endpoint, then selecting "Installation propre" which leads to cleanup.php, and finally selecting "Suppression des fichiers d'installation" which leads to delete.php.

Recommendations For GuppY version 4.0, consider restricting access to the install/install.php endpoint and the subsequent cleanup.php and delete.php scripts to prevent unauthorized file deletion. As a temporary workaround, consider disabling the delete functionality in delete.php until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-1451

Produtos afetados

Guppy

Referências · 6

• 🔥 http://forums.avenir-geopolitique.net/viewtopic.php?t=2728 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1451 · Nota de Segurança
• http://osvdb.org/35085 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1451 · Nota
• http://securityfocus.com/archive/1/462584/100/0/threaded · Nota
• http://securityreason.com/securityalert/2433 · Nota