PT-2007-6911 · Justin Hagstrom · Autoindex Php Script

Publicado 2007-11-15 · Atualizado 2018-10-15 · CVE-2007-5984

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Justin Hagstrom AutoIndex PHP Script versions prior to 2.2.4

Description The issue allows remote attackers to cause a denial of service, consuming CPU and memory, by sending a %00 sequence in the dir parameter to "index.php", triggering an erroneous recursive calculation.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "index.php" endpoint to minimize the risk of exploitation. Avoid using the dir parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-5984

Produtos afetados

Autoindex Php Script

Referências · 9

• 🔥 https://exploit-db.com/exploits/30753 · Exploit
• http://securityfocus.com/bid/26410 · Nota
• http://securityfocus.com/archive/1/483592/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38437 · Nota
• http://securityreason.com/securityalert/3360 · Nota
• http://autoindex.sourceforge.net/change_log.html · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5984 · Nota
• http://osvdb.org/45282 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5984 · Nota de Segurança