PT-2007-3554 · Dmcms · Dmcms

Publicado 2007-04-24 · Atualizado 2018-10-16 · CVE-2007-2214

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DmCMS (affected versions not specified)

Description The issue concerns an unrestricted file upload vulnerability. It allows remote attackers to upload arbitrary PHP scripts. This can be achieved by placing a script's contents in both the File2 and File3 parameters and sending a request to the "ok.php?do=act" endpoint with a specific Referer.

Recommendations As a temporary workaround, consider restricting access to the includes/upload file.php script until a patch is available. Avoid using the File2 and File3 parameters in the affected endpoint until the issue is resolved. Restrict the upload of PHP files to prevent arbitrary script execution.

Correção

Identificadores relacionados

CVE-2007-2214

Produtos afetados

Dmcms

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-2214 · Nota de Segurança
• http://osvdb.org/35636 · Nota
• http://vupen.com/english/advisories/2007/1516 · Nota
• http://securityfocus.com/bid/23628 · Nota
• http://securityfocus.com/archive/1/466704/100/0/threaded · Nota
• http://securityreason.com/securityalert/2605 · Nota