PT-2007-5638 · Dalai · Dalai Forum

Publicado 2007-08-21 · Atualizado 2018-10-15 · CVE-2007-4457

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dalai Forum version 1.1

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the chemin parameter of the forumreply.php file, enabling directory traversal.

Recommendations For Dalai Forum version 1.1, consider restricting access to the chemin parameter in the forumreply.php file to prevent directory traversal attacks. As a temporary workaround, restrict the use of the forumreply.php file until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-4457

Produtos afetados

Dalai Forum

Referências · 6

• 🔥 http://securityfocus.com/bid/25361 · Exploit
• 🔥 https://exploit-db.com/exploits/30509 · Exploit
• http://securityfocus.com/archive/1/477238/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36140 · Nota
• http://osvdb.org/37831 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4457 · Nota de Segurança