PT-2007-5511 · Bilder · Bilder Uploader

Publicado 2007-08-14 · Atualizado 2018-10-15 · CVE-2007-4326

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bilder Uploader version 1.3

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the config[root ordner] parameter to various PHP scripts, including "gruppen.php", "bild.php", "feed.php", "mitglieder.php", "online.php", and "profil.php".

Recommendations For Bilder Uploader version 1.3, consider restricting access to the config[root ordner] parameter in the affected PHP scripts until a patch is available. As a temporary workaround, avoid using the config[root ordner] parameter in the API endpoints related to the specified PHP scripts.

Correção

Identificadores relacionados

CVE-2007-4326

Produtos afetados

Bilder Uploader

Referências · 12

• https://exchange.xforce.ibmcloud.com/vulnerabilities/35922 · Nota
• http://osvdb.org/36445 · Nota
• http://securityfocus.com/archive/1/475954/100/0/threaded · Nota
• http://osvdb.org/36447 · Nota
• http://vupen.com/english/advisories/2007/2836 · Nota
• http://secunia.com/advisories/26399 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4326 · Nota de Segurança
• http://osvdb.org/36448 · Nota
• http://osvdb.org/36446 · Nota
• http://osvdb.org/36444 · Nota
• http://securityreason.com/securityalert/2993 · Nota
• http://osvdb.org/36443 · Nota