PT-2007-4199 · Navboard · Navboard

Dj7Xpl · Publicado 2007-05-30 · Atualizado 2017-10-11 · CVE-2007-2899

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NavBoard version 2.6.0

Description A direct static code injection issue exists, allowing remote attackers to inject arbitrary PHP code into data/config.php via multiple parameters. This is demonstrated through the threadperpage parameter in an editconfig action.

Recommendations For NavBoard version 2.6.0, consider restricting access to the admin config.php file and avoid using the threadperpage parameter in the editconfig action until a patch is available. As a temporary workaround, restrict modifications to the data/config.php file to prevent arbitrary code injection.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-2899

Produtos afetados

Navboard

Referências · 5

• 🔥 https://exploit-db.com/exploits/3971 · Exploit
• 🔥 http://securityfocus.com/bid/24120 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2899 · Nota de Segurança
• http://osvdb.org/42118 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34472 · Nota