PT-2007-6739 · Flatnuke · Flatnuke

Kingoftheworld · Publicado 2007-11-01 · Atualizado 2018-10-15 · CVE-2007-5772

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Flatnuke version 3

Description A direct static code injection issue exists in the download module, allowing remote authenticated administrators to inject arbitrary PHP code into a description.it.php file by saving a description and setting fneditmode to 1. Unauthenticated remote attackers can also exploit this issue by leveraging a cookie manipulation problem.

Recommendations For Flatnuke version 3, as a temporary workaround, consider disabling the download module until a patch is available. Restrict access to the description.it.php file to minimize the risk of exploitation. Avoid using the fneditmode variable in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-5772

Produtos afetados

Flatnuke

Referências · 4

• 🔥 https://exploit-db.com/exploits/4562 · Exploit
• http://securityfocus.com/archive/1/482774/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5772 · Nota de Segurança
• http://osvdb.org/43636 · Nota