PT-2008-4182 · Apache+1 · Apache+1

Egix · Publicado 2008-06-17 · Atualizado 2017-09-29 · CVE-2008-2742

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Achievo versions 1.2.0 through 1.3.2

Description The issue allows remote attackers to execute arbitrary code by uploading a file with a .php extension followed by a safe extension to the mcpuk file editor, and then accessing it via a direct request to the file in the Achievo root directory. This is only a problem in environments that support multiple extensions, such as Apache with the mod mime module enabled.

Recommendations For Achievo versions 1.2.0 through 1.3.2, consider restricting access to the mcpuk file editor to prevent unauthorized file uploads until a patch is available. As a temporary workaround, restrict the execution of files with multiple extensions in the Achievo root directory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-2742

Produtos afetados

Achievo

Apache

Referências · 6

• 🔥 https://exploit-db.com/exploits/5770 · Exploit
• http://securityfocus.com/bid/29621 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42980 · Nota
• http://achievo.org/blog/archives/631-Achievo-1.3.3-Security-Release.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2742 · Nota de Segurança
• http://secunia.com/advisories/30597 · Aviso do Fabricante