PT-2007-6489 · Php · Php-Stats

Egix · Publicado 2007-10-14 · Atualizado 2017-09-29 · CVE-2007-5453

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Php-Stats version 0.1.9.2

Description: The issue allows remote authenticated administrators to execute arbitrary code by injecting PHP sequences into the php-stats-options record in the options table. This is used in an eval function call by files such as admin.php, click.php, and download.php. The injection can be achieved by modifying options through a backup restore action in admin.php.

Recommendations: For Php-Stats version 0.1.9.2, consider restricting access to the admin.php file and other affected files to prevent remote authenticated administrators from exploiting the eval injection vulnerability. As a temporary workaround, avoid using the backup restore action in admin.php until a fix is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-5453

Produtos afetados

Php-Stats

Referências · 4

• 🔥 https://exploit-db.com/exploits/4513 · Exploit
• http://securityfocus.com/bid/26022 · Nota
• http://osvdb.org/43480 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5453 · Nota de Segurança