PT-2007-6174 · Simple Php Blog · Simple Php Blog

Publicado 2007-09-24 · Atualizado 2018-10-15 · CVE-2007-5071

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP Blog versions prior to 0.5.1

Description The issue allows remote attackers to upload dangerous files and execute arbitrary code. This can be achieved by uploading a file with a filename ending in .php or a .htaccess file.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the upload img cgi.php file to minimize the risk of exploitation. Avoid using the upload functionality in the affected version until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2007-5071

Produtos afetados

Simple Php Blog

Referências · 9

• http://secunia.com/advisories/26968 · Nota
• http://simplephpblog.com/index.php?m=09&y=07 · Nota
• http://securityfocus.com/archive/1/480569/100/0/threaded · Nota
• http://securenetwork.it/ricerca/advisory/download/SN-2007-03.txt · Nota
• http://securityfocus.com/archive/1/480092/100/0/threaded · Nota
• http://simplephpblog.com/comments.php?y=07&m=09&entry=entry070923-004446 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5071 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36785 · Nota
• http://securityfocus.com/bid/25747 · Nota