PT-2007-6223 · Php+1 · Php+1

Jesper Jurcenoks · Publicado 2007-09-27 · Atualizado 2018-10-15 · CVE-2007-5128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SimpNews version 2.41.03

Description The issue allows remote attackers to obtain sensitive information via a certain link date parameter to "events.php", which reveals the path in an error message due to an unsupported argument type for the mktime function on Windows. This occurs when PHP before version 5.0.0 is used.

Recommendations For SimpNews version 2.41.03, consider updating PHP to version 5.0.0 or later to resolve the issue. As a temporary workaround, restrict access to the "events.php" endpoint to minimize the risk of exploitation. Avoid using the link date parameter in the affected endpoint until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-5128

Produtos afetados

Php

Simpnews

Referências · 6

• http://securityreason.com/securityalert/3174 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5128 · Nota
• http://forum.boesch-it.de/viewtopic.php?t=2791 · Correção
• http://netvigilance.com/advisory0068 · Nota
• http://securityfocus.com/archive/1/480588/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5128 · Nota de Segurança