PT-2008-4415 · Homeph · Homeph Design

Cracker · Publicado 2008-07-02 · Atualizado 2017-09-29 · CVE-2008-2981

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HomePH Design version 2.10 RC2

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled. This is achieved by providing a URL in the thumb template parameter.

Recommendations For HomePH Design version 2.10 RC2, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the admin/templates/template thumbnail.php file until a patch is available. Avoid using the thumb template parameter in the affected endpoint until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-2981

Produtos afetados

Homeph Design

Referências · 3

• 🔥 https://exploit-db.com/exploits/5903 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43256 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2981 · Nota de Segurança