PT-2007-3915 · Aforum · Aforum

The Tiger · Publicado 2007-05-11 · Atualizado 2017-10-11 · CVE-2007-2596

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aForum versions 1.32 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the CommonAbsDir parameter. This can be achieved by manipulating the URL to include malicious PHP code, which can then be executed by the server.

Recommendations For aForum versions 1.32 and earlier, update to a version later than 1.32 to resolve the issue. As a temporary workaround, consider restricting access to the common/func.php file to minimize the risk of exploitation. Avoid using the CommonAbsDir parameter in URLs until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-2596

Produtos afetados

Aforum

Referências · 7

• 🔥 https://exploit-db.com/exploits/3884 · Exploit
• http://secunia.com/advisories/25224 · Nota
• http://vupen.com/english/advisories/2007/1739 · Nota
• http://securityfocus.com/bid/23902 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34202 · Nota
• http://osvdb.org/35907 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2596 · Nota de Segurança