PT-2007-4076 · Bif3 · Build It Fast

Alkomandoz Hacker · Publicado 2007-05-18 · Atualizado 2017-10-11 · CVE-2007-2762

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Build it Fast (bif3) version 0.4.1

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the pear dir parameter to Base/Application.php, or the sys dir parameter to various PHP files in the Widgets/Base/ directory, including Footer.php, widget.BifContainer.php, widget.BifRoot.php, widget.BifRoot2.php, widget.BifRoot3.php, and widget.BifWarning.php.

Recommendations For Build it Fast (bif3) version 0.4.1, consider restricting access to the pear dir and sys dir parameters in the affected PHP files until a patch is available. As a temporary workaround, avoid using the pear dir parameter in the Base/Application.php file and the sys dir parameter in the Footer.php, widget.BifContainer.php, widget.BifRoot.php, widget.BifRoot2.php, widget.BifRoot3.php, and widget.BifWarning.php files in the Widgets/Base/ directory.

Exploit

Correção

Identificadores relacionados

CVE-2007-2762

Produtos afetados

Build It Fast

Referências · 11

• 🔥 https://exploit-db.com/exploits/3947 · Exploit
• http://osvdb.org/37954 · Nota
• http://osvdb.org/37950 · Nota
• http://osvdb.org/37953 · Nota
• http://securityfocus.com/bid/24045 · Nota
• http://osvdb.org/37951 · Nota
• http://osvdb.org/37955 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34362 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2762 · Nota de Segurança
• http://osvdb.org/37949 · Nota
• http://osvdb.org/37952 · Nota