PT-2007-6847 · Jbc · Jbc Explorer

Darkfig · Publicado 2007-11-10 · Atualizado 2018-10-15 · CVE-2007-5914

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JBC Explorer versions 7.20 RC1 and earlier

Description A direct static code injection issue exists, allowing remote authenticated administrators to inject arbitrary PHP code via the DEBUG parameter. This code can be executed by accessing config.inc.php. It's also possible for unauthenticated remote attackers to exploit this issue.

Recommendations For JBC Explorer versions 7.20 RC1 and earlier, consider disabling access to the config/post.php module until a fix is available. As a temporary workaround, restrict the use of the DEBUG parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-5914

Produtos afetados

Jbc Explorer

Referências · 7

• 🔥 https://exploit-db.com/exploits/4608 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5914 · Nota de Segurança
• http://securityfocus.com/archive/1/483268/100/0/threaded · Nota
• http://secunia.com/advisories/27533 · Aviso do Fabricante
• http://securityreason.com/securityalert/3358 · Nota
• http://mgsdl.free.fr/?1:33 · Nota
• http://osvdb.org/42070 · Nota