PT-2008-2022 · Auracms · Auracms+1

K1Tk4T · Publicado 2008-01-23 · Atualizado 2017-09-29 · CVE-2008-0390

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AuraCMS version 1.62 Mod Block Statistik for AuraCMS

Description The issue allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to "index.php", and then execute online.db.txt via a certain request to "index.php".

Recommendations For AuraCMS version 1.62, consider disabling the stat action to index.php until a patch is available. For Mod Block Statistik for AuraCMS, restrict access to the online.db.txt file to minimize the risk of exploitation. Avoid using the X-Forwarded-For HTTP header in the stat action to index.php until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0390

Produtos afetados

Auracms

Mod Block Statistik

Referências · 4

• 🔥 http://securityfocus.com/bid/27342 · Exploit
• 🔥 https://exploit-db.com/exploits/4933 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39777 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0390 · Nota de Segurança