PT-2008-4103 · Cmsimple · Cmsimple

Irk4Z · Publicado 2008-06-10 · Atualizado 2017-09-29 · CVE-2008-2650

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMSimple version 3.1

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files by providing a .. (dot dot) in the sl parameter to "index.php". This can be used for remote file execution by including "adm.php" and then invoking the upload action.

Recommendations For CMSimple version 3.1, update to the patched version released on 20080601, even though the version number remains unchanged.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-2650

Produtos afetados

Cmsimple

Referências · 9

• 🔥 http://securityfocus.com/bid/29450 · Exploit
• 🔥 https://exploit-db.com/exploits/5700 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42793 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42792 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2650 · Nota de Segurança
• http://cmsimple.com/forum/viewtopic.php?f=2&t=17 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2650 · Nota
• http://secunia.com/advisories/30463 · Aviso do Fabricante
• http://osvdb.org/45881 · Nota