PT-2008-3547 · Minibb · Minibb

Girex · Publicado 2008-04-30 · Atualizado 2017-09-29 · CVE-2008-2028

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions miniBB versions 2.2 and earlier

Description The issue allows remote attackers to obtain the full path of the system via a direct request to the glang parameter in a registernew action to "index.php". This is possible when register globals is enabled, and it leaks the path in an error message.

Recommendations For miniBB versions 2.2 and earlier, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the index.php file, specifically the registernew action, until a patch is available. Avoid using the glang parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-2028

Produtos afetados

Minibb

Referências · 6

• 🔥 https://exploit-db.com/exploits/5494 · Exploit
• http://minibb.net/forums/9_5110_0.html · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42012 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2028 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2028 · Nota
• http://secunia.com/advisories/29997 · Aviso do Fabricante