PT-2008-3093 · Powerphp · Powerphpboard

Publicado 2008-03-28 · Atualizado 2018-10-11 · CVE-2008-1534

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PowerPHPBoard version 1.00b

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the settings[footer] parameter to "footer.inc.php" and the settings[header] parameter to "header.inc.php".

Recommendations For PowerPHPBoard version 1.00b, consider restricting access to the vulnerable parameters settings[footer] and settings[header] to minimize the risk of exploitation. Avoid using the .. (dot dot) sequence in these parameters until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-1534

Produtos afetados

Powerphpboard

Referências · 7

• 🔥 https://exploit-db.com/exploits/5303 · Exploit
• http://securityreason.com/securityalert/3782 · Nota
• http://securityfocus.com/archive/1/490011/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41403 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1534 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0992/references · Nota
• http://securityfocus.com/bid/28421 · Nota