PT-2008-4271 · Full Revolution · Full Revolution Aspwebcalendar 2008

Alemin_Krali · Publicado 2008-06-24 · Atualizado 2017-09-29 · CVE-2008-2832

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Full Revolution aspWebCalendar 2008

Description The issue concerns an unrestricted file upload vulnerability. This vulnerability allows remote attackers to upload and execute arbitrary code via the FILE1 parameter in an "uploadfileprocess" action, likely followed by a direct request to the file in "calendar/eventimages/".

Recommendations For Full Revolution aspWebCalendar 2008, restrict access to the "uploadfileprocess" action and the "calendar/eventimages/" directory to prevent arbitrary code execution. Consider implementing validation and restrictions on file uploads to mitigate the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-2832

Produtos afetados

Full Revolution Aspwebcalendar 2008

Referências · 5

• 🔥 http://securityfocus.com/bid/29795 · Exploit
• 🔥 https://exploit-db.com/exploits/5850 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2832 · Nota de Segurança
• http://downloads.securityfocus.com/vulnerabilities/exploits/29795.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43201 · Nota