PT-2008-3033 · W Agora · W-Agora

Publicado 2008-03-24 · Atualizado 2017-08-08 · CVE-2008-1466

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions W-Agora version 4.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the bn dir default parameter to various PHP files, including "add user.php", "create forum.php", "create user.php", "delete notes.php", "delete user.php", "edit forum.php", "mail users.php", "moderate notes.php", and "reorder forums.php".

Recommendations For W-Agora version 4.0, consider restricting access to the bn dir default parameter in the affected PHP files until a patch is available. As a temporary workaround, avoid using the bn dir default parameter in the specified API endpoints.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-1466

Produtos afetados

W-Agora

Referências · 13

• 🔥 https://exploit-db.com/exploits/31453 · Exploit
• 🔥 https://exploit-db.com/exploits/31452 · Exploit
• 🔥 https://exploit-db.com/exploits/31457 · Exploit
• 🔥 https://exploit-db.com/exploits/31449 · Exploit
• 🔥 http://securityfocus.com/bid/28366 · Exploit
• 🔥 https://exploit-db.com/exploits/31450 · Exploit
• 🔥 https://exploit-db.com/exploits/31456 · Exploit
• 🔥 https://exploit-db.com/exploits/31455 · Exploit
• 🔥 https://exploit-db.com/exploits/31454 · Exploit
• 🔥 https://exploit-db.com/exploits/31451 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1466 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41352 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1466 · Nota