PT-2008-3840 · Smeego · Smeego

0In · Publicado 2008-05-20 · Atualizado 2018-10-11 · CVE-2008-2352

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Smeego version 1.0

Description: The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, when magic quotes gpc is disabled. This is a directory traversal vulnerability in the index.php file.

Recommendations: For Smeego version 1.0, consider disabling the index.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent the exploitation of this issue. Restrict the use of the lang cookie to minimize the risk of directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-2352

Produtos afetados

Smeego

Referências · 7

• 🔥 https://exploit-db.com/exploits/5640 · Exploit
• http://vupen.com/english/advisories/2008/1563/references · Nota
• http://secunia.com/advisories/30138 · Aviso do Fabricante
• http://securityfocus.com/bid/29264 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42498 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2352 · Nota de Segurança
• http://securityfocus.com/archive/1/492227/100/0/threaded · Nota