PT-2008-3536 · Chilek · Chilek Content Management System

Hadi Kiamarsi · Publicado 2008-04-30 · Atualizado 2018-10-11 · CVE-2008-2016

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chilek Content Management System (aka ChiCoMaS) version 2.0.4

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/. This can also be leveraged to include and execute arbitrary local files via directory traversal sequences.

Recommendations For Chilek Content Management System (aka ChiCoMaS) version 2.0.4, consider restricting access to the install/ directory and validating the lang parameter to prevent directory traversal sequences until a patch is available. Avoid using the lang parameter in the affected API endpoint until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-2016

Produtos afetados

Chilek Content Management System

Referências · 4

• http://securityreason.com/securityalert/3837 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42144 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2016 · Nota de Segurança
• http://securityfocus.com/archive/1/491369/100/0/threaded · Nota