PT-2007-6156 · Unknown · Izicontents
Irk4Z
·
Publicado
2007-09-24
·
Atualizado
2017-09-29
·
CVE-2007-5053
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
iziContents versions 1 RC6 and earlier
Description
The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This is due to incomplete blacklist vulnerabilities, which are related to missing checks for the inclusion of certain URLs. The affected parameters include
admin home in modules/poll/poll summary.php, rootdp in include/db.php, and language home in several other files, such as search/search.php, poll/inlinepoll.php, poll/showpoll.php, links/showlinks.php, and links/submit links.php. An example of exploitation is using an ftps:// URL.Recommendations
For iziContents versions 1 RC6 and earlier, consider disabling the affected parameters, such as
admin home, rootdp, and language home, until a patch is available. Restrict access to the vulnerable modules, including modules/poll/poll summary.php, include/db.php, search/search.php, poll/inlinepoll.php, poll/showpoll.php, links/showlinks.php, and links/submit links.php, to minimize the risk of exploitation. Avoid using URLs that could be used to exploit the missing checks in modules/moduleSec.php and include/includeSec.php. At the moment, there is no information about a newer version that contains a fix for this issue.Exploit
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Izicontents