PT-2007-3349 · Taskhopper · Taskhopper

Cold Z3Ro · Publicado 2007-04-12 · Atualizado 2017-10-11 · CVE-2007-2005

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Taskhopper version 1.1

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig absolute path parameter to various PHP files, including "contact type.php", "itemstatus type.php", "projectstatus type.php", "request type.php", "responses type.php", "timelog type.php", and "urgency type.php" in the "inc/" directory.

Recommendations For Taskhopper version 1.1, consider restricting access to the mosConfig absolute path parameter to prevent remote file inclusion attacks. As a temporary workaround, restrict access to the affected PHP files in the "inc/" directory until a patch is available. Avoid using the mosConfig absolute path parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-2005

Produtos afetados

Taskhopper

Referências · 13

• 🔥 https://exploit-db.com/exploits/3703 · Exploit
• http://osvdb.org/34799 · Nota
• http://securityfocus.com/bid/23408 · Nota
• http://osvdb.org/34801 · Nota
• http://osvdb.org/34795 · Nota
• http://osvdb.org/34800 · Nota
• http://osvdb.org/34797 · Nota
• http://osvdb.org/34796 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33552 · Nota
• http://osvdb.org/34798 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2005 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1346 · Nota
• http://attrition.org/pipermail/vim/2007-April/001504.html · Nota