PT-2008-4352 · Devalcms · Devalcms

Cwh Underground · Publicado 2008-06-30 · Atualizado 2017-09-29 · CVE-2008-2913

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Devalcms version 1.4a

Description A directory traversal issue exists due to the lack of proper input validation in the func.php file when magic quotes gpc is disabled. This allows remote attackers to include and execute arbitrary local files by manipulating the currentpath parameter with a .. (dot dot) sequence, in combination with specific ... (triple dot) and ..... sequences in the currentfile parameter, to index.php.

Recommendations For Devalcms version 1.4a, consider disabling the execution of external files through the func.php file until a proper patch is available, and ensure magic quotes gpc is enabled to mitigate the risk of directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-2913

Produtos afetados

Devalcms

Referências · 5

• 🔥 http://securityfocus.com/bid/29728 · Exploit
• 🔥 https://exploit-db.com/exploits/5822 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43116 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2913 · Nota de Segurança
• http://secunia.com/advisories/30585 · Aviso do Fabricante