PT-2007-3144 · Kaqoo · Kaqoo Auction

The De@Th

·

Publicado

2007-03-31

·

Atualizado

2017-10-11

·

CVE-2007-1790

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Kaqoo Auction Software Free Edition (affected versions not specified)
Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the install root parameter to multiple PHP files. This includes files such as "support.inc.php", "function.inc.php", "rdal object.inc.php", and others in various directories like "include/core/", "include/display/item/", and "include/display/". The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the use of API endpoints and vulnerable parameters or variables, such as the install root parameter.
Recommendations: As a temporary workaround, consider disabling the vulnerable PHP files until a patch is available. Restrict access to the vulnerable directories to minimize the risk of exploitation. Avoid using the install root parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-1790

Produtos afetados

Kaqoo Auction