PT-2007-6062 · Webmedia · Webmedia Explorer

Publicado 2007-09-18 · Atualizado 2008-11-15 · CVE-2007-4948

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webmedia Explorer version 3.2.2

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved via several parameters, including path include to includes/rss.class.php, path template to templates/main.tpl.php or templates/folder messages link message name.tpl.php, and path templates to templates/sidebar.tpl.php. The vulnerability is only present if the administrator fails to follow installation instructions regarding .htaccess support.

Recommendations For Webmedia Explorer version 3.2.2, ensure that the administrator follows the installation instructions about the requirement for .htaccess support to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the vulnerable parameters path include, path template, and path templates until the issue is resolved.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-4948

Produtos afetados

Webmedia Explorer

Referências · 7

• http://arfis.wordpress.com/2007/09/14/rfi-03-webmedia-explorer · Nota
• http://osvdb.org/43141 · Nota
• http://osvdb.org/43140 · Nota
• http://osvdb.org/43143 · Nota
• http://osvdb.org/43142 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4948 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4948 · Nota