PT-2008-1877 · Zerocms · Zerocms

Kingoftheworld · Publicado 2008-01-11 · Atualizado 2017-09-29 · CVE-2008-0233

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zero CMS versions 1.0 Alpha and earlier

Description The issue allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg. This enables attackers to potentially execute malicious code on the server.

Recommendations For Zero CMS versions 1.0 Alpha and earlier, consider restricting the upload of files to only necessary and validated types to prevent the execution of arbitrary files. As a temporary workaround, restrict access to the avatar upload feature until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-0233

Produtos afetados

Zerocms

Referências · 3

• 🔥 https://exploit-db.com/exploits/4864 · Exploit
• http://packetstormsecurity.org/0801-exploits/zerocms-sql.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0233 · Nota de Segurança