PT-2007-3571 · Punbb · Punbb

Darkfig · Publicado 2007-04-25 · Atualizado 2018-10-16 · CVE-2007-2234

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PunBB versions 1.2.14 and earlier

Description The issue arises from improper handling of a disabled ini get function when checking the register globals setting in include/common.php. This allows remote attackers to register global parameters. An example of exploitation is an SQL injection attack on the search id parameter to "search.php".

Recommendations For PunBB versions 1.2.14 and earlier, consider disabling the register globals setting to prevent global parameter registration until a proper fix is applied. As a temporary workaround, restrict access to the "search.php" endpoint to minimize the risk of SQL injection attacks. Avoid using the search id parameter in the affected endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-2234

Produtos afetados

Punbb

Referências · 7

• http://securityfocus.com/archive/1/465400/100/100/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2234 · Nota de Segurança
• http://dev.punbb.org/changeset/933 · Nota
• http://securityfocus.com/archive/1/465338/100/100/threaded · Nota
• http://securityreason.com/securityalert/2613 · Nota
• http://acid-root.new.fr/advisories/13070411.txt · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2234 · Nota