PT-2007-6784 · Axdcms · Ax Developer Cms

Gold_M · Publicado 2007-11-05 · Atualizado 2017-09-29 · CVE-2007-5820

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ax Developer CMS (AxDCMS) version 0.1.1

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter. This can be exploited by sending a malicious request to the /index.php endpoint.

Recommendations For Ax Developer CMS (AxDCMS) version 0.1.1, consider restricting access to the module parameter in the index.php file to minimize the risk of exploitation. Avoid using the module parameter with untrusted input until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5820

Produtos afetados

Ax Developer Cms

Referências · 6

• 🔥 https://exploit-db.com/exploits/4599 · Exploit
• http://osvdb.org/39021 · Nota
• http://securityfocus.com/bid/26306 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5820 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3749 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38224 · Nota