PT-2008-1631 · Myspace · Myspace Content Zone

Breaker_Unit + 1 · Publicado 2008-01-08 · Atualizado 2017-10-19 · CVE-2007-6668

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MySpace Content Zone (MCZ) version 3.x

Description The issue concerns the admin/uploadgames.php file, which does not require administrative privileges. This allows remote attackers to perform unrestricted file uploads. Attackers can upload malicious files, such as .php files or files with names like .php%00.jpeg, to potentially execute arbitrary code.

Recommendations For MySpace Content Zone (MCZ) version 3.x, restrict access to the admin/uploadgames.php file to require administrative privileges, and validate all file uploads to prevent malicious files from being uploaded. As a temporary workaround, consider disabling the file upload functionality in admin/uploadgames.php until a proper fix is implemented.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-6668

Produtos afetados

Myspace Content Zone

Referências · 5

• 🔥 https://exploit-db.com/exploits/4741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6668 · Nota de Segurança
• http://osvdb.org/40211 · Nota
• http://securityfocus.com/bid/27062 · Nota
• http://secunia.com/advisories/28159 · Aviso do Fabricante