PT-2007-6281 · Xoops · Xoops

Phppp · Publicado 2007-10-03 · Atualizado 2011-03-08 · CVE-2007-5188

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xoops versions 2.0.17.1-RC1 and earlier

Description The issue is related to an unspecified vulnerability in the XOOPS uploader class, allowing remote attackers to upload arbitrary files. This is possibly due to improper upload configuration settings in class/uploader.php and class/mimetypes.inc.php, which may include an incomplete blacklist that omits the .php4 extension.

Recommendations For Xoops versions 2.0.17.1-RC1 and earlier, consider restricting access to the uploader class until a fix is available. As a temporary workaround, review and update the upload configuration settings in class/uploader.php and class/mimetypes.inc.php to ensure that all potentially executable file extensions, including .php4, are properly blacklisted.

Correção

Identificadores relacionados

CVE-2007-5188

Produtos afetados

Xoops

Referências · 8

• http://securityfocus.com/bid/25878 · Nota
• http://osvdb.org/41386 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5188 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5188 · Nota de Segurança
• http://sourceforge.net/project/shownotes.php?group_id=41586&release_id=543338 · Nota
• http://secunia.com/advisories/27006 · Aviso do Fabricante
• http://xoops.org/modules/news/article.php?storyid=3963 · Nota
• http://vupen.com/english/advisories/2007/3315 · Nota