PT-2007-4091 · Alstrasoft · Alstrasoft Template Seller Pro

Blackhawk · Publicado 2007-05-21 · Atualizado 2017-10-11 · CVE-2007-2777

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlstraSoft Template Seller Pro versions 3.25 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via an unrestricted file upload vulnerability. This is achieved by uploading an arbitrary .php filename in the zip parameter, which is then created under the sptemplates/ directory.

Recommendations For versions 3.25 and earlier, consider disabling the file upload functionality in admin/addsptemplate.php until a patch is available. Restrict access to the sptemplates/ directory to minimize the risk of exploitation. Avoid using the zip parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-2777

Produtos afetados

Alstrasoft Template Seller Pro

Referências · 5

• 🔥 https://exploit-db.com/exploits/3959 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2777 · Nota de Segurança
• http://osvdb.org/40423 · Nota
• http://securityfocus.com/bid/24068 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34398 · Nota