PT-2008-4569 · Neutrino · Neutrino Atomic Edition

Ams · Publicado 2008-07-11 · Atualizado 2017-09-29 · CVE-2008-3150

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Neutrino Atomic Edition version 0.8.4

Description: The issue allows remote attackers to read and modify files due to a directory traversal vulnerability in index.php. This can be exploited by manipulating data/sess.php in certain actions, such as 'usb' and 'del pag' actions. It is also possible to leverage this issue for code execution by performing an upload that bypasses access restrictions implemented in sess.php.

Recommendations: For Neutrino Atomic Edition version 0.8.4, consider restricting access to the vulnerable index.php file and the data/sess.php file until a patch is available. As a temporary workaround, avoid using the 'usb' and 'del pag' actions in index.php to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3150

Produtos afetados

Neutrino Atomic Edition

Referências · 5

• 🔥 https://exploit-db.com/exploits/6018 · Exploit
• http://secunia.com/advisories/30950 · Aviso do Fabricante
• http://securityfocus.com/bid/30123 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43616 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3150 · Nota de Segurança