PT-2008-3393 · Exbb · Exbb Italia

The:Paradox · Publicado 2008-04-17 · Atualizado 2017-09-29 · CVE-2008-1862

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ExBB Italia versions 0.22 and earlier

Description The issue allows remote attackers to bypass a check by using vectors other than GET requests with QUERY STRING, specifically via (1) POST or (2) COOKIE variables. This can be leveraged to conduct PHP remote file inclusion attacks by manipulating the new exbb[home path] or exbb[home path] parameter in the "modules/threadstop/threadstop.php" endpoint.

Recommendations For ExBB Italia versions 0.22 and earlier, as a temporary workaround, consider restricting access to the modules/threadstop/threadstop.php endpoint to minimize the risk of exploitation. Avoid using the new exbb[home path] and exbb[home path] parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

RCE

Enumeração de Fraquezas

CWE-94

CWE-20

Identificadores relacionados

CVE-2008-1862

Produtos afetados

Exbb Italia

Referências · 4

• 🔥 https://exploit-db.com/exploits/5405 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41708 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1862 · Nota de Segurança
• http://secunia.com/advisories/29739 · Aviso do Fabricante