PT-2007-4675 · Dreamlog · Dreamlog

Dj7Xpl · Publicado 2007-06-26 · Atualizado 2017-10-11 · CVE-2007-3403

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dreamLog (aka dreamblog) version 0.5

Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to upload and execute arbitrary PHP code in the uploads/images/ directory via the uploadedFile[] parameter in the upload.php file.

Recommendations For dreamLog (aka dreamblog) version 0.5, restrict access to the upload.php file to prevent arbitrary file uploads, and consider validating and sanitizing the uploadedFile[] parameter to prevent code execution.

Exploit

Correção

Identificadores relacionados

CVE-2007-3403

Produtos afetados

Dreamlog

Referências · 6

• 🔥 https://exploit-db.com/exploits/4106 · Exploit
• http://securityfocus.com/bid/24639 · Nota
• http://osvdb.org/45385 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3403 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35054 · Nota
• http://vupen.com/english/advisories/2007/2326 · Nota