PT-2007-5382 · Open Source Matters · Joomla!

Johannes Greil · Publicado 2007-08-08 · Atualizado 2018-10-15 · CVE-2007-4187

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Joomla! version 1.5 beta before RC1

Description The issue allows remote attackers to execute arbitrary PHP code via PHP sequences in the searchword parameter, related to default results.php in components/com search/views/search/tmpl/ and templates/beez/html/com search/search/.

Recommendations For Joomla! version 1.5 beta before RC1, consider restricting access to the com search component until a fix is available. As a temporary workaround, avoid using the searchword parameter in the affected API endpoint until the issue is resolved.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-4187

Produtos afetados

Joomla!

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-4187 · Nota de Segurança
• http://securityreason.com/securityalert/2969 · Nota
• http://joomlacode.org/gf/project/joomla/scmsvn/?action=browse&path=%2Fdevelopment%2Ftrunk%2Fcomponents%2Fcom_search%2Fviews%2Fsearch%2Fview.php&r1=7455&r2=7456 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4187 · Nota
• http://osvdb.org/41260 · Nota
• http://securityfocus.com/archive/1/474417/100/100/threaded · Nota