PT-2007-5661 · Php · Php

Publicado 2007-08-22 · Atualizado 2018-10-15 · CVE-2007-4485

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Butterfly online visitors counter version 1.08

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the SERVER[DOCUMENT ROOT] parameter, specifically in the visitor.php file. This is possible when used with certain older versions of PHP that have improper SERVER superglobal handling.

Recommendations For Butterfly online visitors counter version 1.08, consider updating PHP to a version that properly handles the SERVER superglobal to mitigate the risk of exploitation. As a temporary workaround, restrict access to the visitor.php file to minimize the risk of arbitrary PHP code execution. Avoid using the SERVER[DOCUMENT ROOT] parameter in the affected visitor.php file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-4485

Produtos afetados

Php

Referências · 7

• 🔥 http://securityvulns.com/Rdocument845.html · Exploit
• http://securityfocus.com/archive/1/477253/100/0/threaded · Nota
• http://securityvulns.com/source26994.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36147 · Nota
• http://osvdb.org/38327 · Nota
• http://securityfocus.com/archive/1/482006/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4485 · Nota de Segurança