PT-2007-7007 · Talkback · Talkback

Noge · Publicado 2007-11-23 · Atualizado 2018-10-15 · CVE-2007-6105

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TalkBack version 2.2.7

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in certain PHP files. This can be achieved by manipulating the language file parameter in files such as comments-display-tpl.php and addons/separate-comments-mod/my-comments-display-tpl.php, or the config[comments form tpl] parameter in comments-display-tpl.php.

Recommendations For TalkBack version 2.2.7, consider restricting access to the comments-display-tpl.php and addons/separate-comments-mod/my-comments-display-tpl.php files to minimize the risk of exploitation. Avoid using the language file and config[comments form tpl] parameters in the affected files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-6105

Produtos afetados

Talkback

Referências · 12

• 🔥 https://exploit-db.com/exploits/4640 · Exploit
• http://secunia.com/advisories/27767 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/3963 · Nota
• http://osvdb.org/38816 · Nota
• http://securityfocus.com/bid/26520 · Nota
• http://scripts.oldguy.us/forums/index.php/topic%2C290.0.html · Nota
• http://osvdb.org/38815 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6105 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38596 · Nota
• http://securityfocus.com/archive/1/484045/100/0/threaded · Nota
• http://securityfocus.com/archive/1/485662/100/100/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38597 · Nota