PT-2008-1890 · Unknown · Uploadscript

Dj7Xpl · Publicado 2008-01-12 · Atualizado 2017-09-29 · CVE-2008-0246

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UploadScript version 1.0

Description The issue allows remote attackers to gain administrator privileges due to a lack of original password verification when changing to a new password. This is achieved via the pass parameter in a 'nopass' (Set Password) action.

Recommendations For UploadScript version 1.0, consider disabling the password change functionality until a patch is available to enforce original password checks before allowing changes to a new password. Restrict access to the admin.php script to minimize the risk of exploitation. Avoid using the pass parameter in the 'nopass' action for the time being.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-0246

Produtos afetados

Uploadscript

Referências · 4

• 🔥 http://securityfocus.com/bid/27203 · Exploit
• 🔥 https://exploit-db.com/exploits/4871 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0246 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39570 · Nota