PT-2007-7382 · Pmos · Pmos Help Desk

Egix · Publicado 2007-12-28 · Atualizado 2017-09-29 · CVE-2007-6550

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PMOS Help Desk versions 2.4 and earlier

Description The issue allows remote attackers to conduct eval injection attacks and execute arbitrary PHP code via the options array parameter in the form.php file. This is possible because form.php sends a redirect to the web browser but does not exit.

Recommendations For PMOS Help Desk versions 2.4 and earlier, consider disabling the form.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the options array parameter in the form.php file to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2007-6550

Produtos afetados

Pmos Help Desk

Referências · 7

• 🔥 https://exploit-db.com/exploits/4789 · Exploit
• http://secunia.com/advisories/28201 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6550 · Nota de Segurança
• http://securityfocus.com/bid/27032 · Nota
• http://osvdb.org/42662 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39274 · Nota
• http://vupen.com/english/advisories/2007/4321 · Nota