PT-2008-2082 · Blog:Cms · Blog:Cms

Romancyxhacker · Publicado 2008-01-24 · Atualizado 2018-10-15 · CVE-2008-0450

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BLOG:CMS version 4.2.1.c

Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via a URL in the DIR PLUGINS parameter to "index.php", and the DIR LIBS parameter to "media.php" and "xmlrpc/server.php" in the admin directory.

Recommendations For BLOG:CMS version 4.2.1.c, consider disabling the DIR PLUGINS and DIR LIBS parameters in the affected API endpoints until a patch is available. Restrict access to "index.php", "media.php", and "xmlrpc/server.php" to minimize the risk of exploitation. Avoid using the DIR PLUGINS and DIR LIBS parameters in the affected API endpoints until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0450

Produtos afetados

Blog:Cms

Referências · 3

• http://securityfocus.com/archive/1/486743/100/0/threaded · Nota
• http://securityreason.com/securityalert/3576 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0450 · Nota de Segurança