PT-2008-2421 · Lookstrike · Lookstrike Lan Manager

Mhz91 · Publicado 2008-02-15 · Atualizado 2017-09-29 · CVE-2008-0803

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LookStrike Lan Manager version 0.9

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the sys conf[path][real] parameter to various PHP files. This can be leveraged to include and execute arbitrary local files via directory traversal sequences. The affected files include multiple PHP scripts in the modulesclass and modulesclassdb directories, as well as modulesclasstournament.

Recommendations For LookStrike Lan Manager version 0.9, consider restricting access to the sys conf[path][real] parameter to prevent remote file inclusion attacks. As a temporary workaround, restrict access to the affected PHP files in the modulesclass, modulesclassdb, and modulesclasstournament directories until a patch is available. Avoid using the sys conf[path][real] parameter in URLs to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-0803

Produtos afetados

Lookstrike Lan Manager

Referências · 3

• 🔥 https://exploit-db.com/exploits/5121 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0803 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/40519 · Nota