PT-2007-2849 · Netenberg+1 · Fantastico+1

Publicado 2007-03-14 · Atualizado 2018-10-16 · CVE-2007-1455

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cPanel versions 10.x

Description The issue concerns absolute path traversal vulnerabilities in Fantastico, used with cPanel. Remote authenticated users can exploit this to include and execute arbitrary local files. This can be achieved via the userlanguage parameter to "includes/load language.php" or the fantasticopath parameter to "includes/mysqlconfig.php" and certain other files.

Recommendations For cPanel version 10.x, consider restricting access to the includes/load language.php and includes/mysqlconfig.php files until a patch is available. As a temporary workaround, avoid using the userlanguage and fantasticopath parameters in the affected API endpoints.

Exploit

Correção

Identificadores relacionados

CVE-2007-1455

Produtos afetados

Fantastico

Cpanel

Referências · 6

• 🔥 https://exploit-db.com/exploits/3459 · Exploit
• http://securityfocus.com/archive/1/462562/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1455 · Nota de Segurança
• http://osvdb.org/35037 · Nota
• http://osvdb.org/35036 · Nota
• http://securityreason.com/securityalert/2420 · Nota