PT-2007-4058 · W2Box · W2Box

Publicado 2007-05-17 · Atualizado 2017-07-29 · CVE-2007-2742

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions w2box version 4.0.0 Beta4

Description The issue allows remote attackers to upload arbitrary PHP code via a filename with a double extension, such as .php.jpg, enabling potential code execution on the server.

Recommendations For version 4.0.0 Beta4, consider restricting file uploads to only allow specific, verified extensions to prevent arbitrary PHP code execution. As a temporary workaround, restrict access to file upload functionality until a proper fix is applied.

Exploit

Correção

Identificadores relacionados

CVE-2007-2742

Produtos afetados

W2Box

Referências · 5

• 🔥 http://marc.info/?l=bugtraq&m=117924253030935&w=2 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34302 · Nota
• http://securityfocus.com/bid/23975 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2742 · Nota de Segurança
• http://osvdb.org/36830 · Nota