PT-2007-6260 · Phplist · Phplist

Arfis · Publicado 2007-10-01 · Atualizado 2008-09-05 · CVE-2007-5167

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phplist versions prior to 0.5-pre2

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the nom rep systeme parameter in the .systeme/fonctions.php file.

Recommendations For versions prior to 0.5-pre2, avoid using the nom rep systeme parameter in the affected API endpoint until the issue is resolved. Restrict access to the .systeme/fonctions.php file to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-5167

Produtos afetados

Phplist

Referências · 2

• 🔥 http://arfis.wordpress.com/2007/09/14/rfi-02-phplister · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5167 · Nota de Segurança