PT-2007-6853 · Picoflat · Picoflat Cms

Publicado 2007-11-10 · Atualizado 2017-07-29 · CVE-2007-5920

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PicoFlat CMS versions prior to 0.4.18

Description The issue allows remote attackers to include certain files via unspecified vectors, possibly due to a directory traversal vulnerability. This can be leveraged to bypass authentication and upload files by including pico insert.php or other administrative scripts.

Recommendations For versions prior to 0.4.18, update to version 0.4.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the pico insert.php script and other administrative scripts to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5920

Produtos afetados

Picoflat Cms

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-5920 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38310 · Nota
• http://securityfocus.com/bid/26362 · Nota
• http://picoflat.altervista.org · Nota
• http://secunia.com/advisories/27504 · Aviso do Fabricante
• http://osvdb.org/42106 · Nota