PT-2007-4001 · Jetbox · Jetbox Cms

Jesper Jurcenoks · Publicado 2007-05-21 · Atualizado 2018-10-16 · CVE-2007-2684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jetbox CMS version 2.1

Description The issue allows remote attackers to obtain sensitive information. This can be achieved through a direct request to certain PHP files, such as main page.php, open tree.php, and outputs.php. Additionally, a malformed view parameter to index.php can be used, potentially allowing SQL injection manipulation. The id[] parameter to admin/cms/opentree.php can also reveal the installation path in the resulting error message.

Recommendations For Jetbox CMS version 2.1, consider restricting access to the main page.php, open tree.php, and outputs.php files, as well as validating and sanitizing the view parameter in index.php to prevent SQL injection. Also, restrict the use of the id[] parameter in admin/cms/opentree.php to minimize the risk of path disclosure.

Exploit

Correção

Identificadores relacionados

CVE-2007-2684

Produtos afetados

Jetbox Cms

Referências · 10

• 🔥 http://marc.info/?l=full-disclosure&m=117974375029054&w=2 · Exploit
• 🔥 http://netvigilance.com/advisory0027 · Exploit
• http://osvdb.org/34790 · Nota
• http://osvdb.org/34783 · Nota
• http://securityfocus.com/archive/1/469222/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34385 · Nota
• http://osvdb.org/34789 · Nota
• http://osvdb.org/34787 · Nota
• http://osvdb.org/34788 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2684 · Nota de Segurança