PT-2007-3194 · Apache · Apache Http Server

Gold_M · Publicado 2007-04-03 · Atualizado 2017-10-11 · CVE-2007-1842

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: JSBoard versions prior to 2.0.12

Description: A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files by injecting a .. (dot dot) in the table parameter of the login.php file. This can be used to inject PHP sequences into an Apache HTTP Server log file.

Recommendations: For versions prior to 2.0.12, update to version 2.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the login.php file to minimize the risk of exploitation. Avoid using the table parameter in the login.php file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-1842

Produtos afetados

Apache Http Server

Referências · 8

• 🔥 http://kldp.net/plugins/scmcvs/cvsweb.php/jsboard-2/login.php.diff?r1=1.8;r2=1.9;cvsroot=jsboard · Exploit
• 🔥 http://securityfocus.com/bid/23223 · Exploit
• 🔥 https://exploit-db.com/exploits/3614 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1842 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33338 · Nota
• http://vupen.com/english/advisories/2007/1182 · Nota
• http://kldp.net/plugins/scmcvs/cvsweb.php/jsboard-2/login.php.diff?r1=1.8%3Br2=1.9%3Bcvsroot=jsboard · Nota
• http://osvdb.org/37365 · Nota