PT-2008-4582 · Fuzzylime · Fuzzylime

Publicado 2008-07-14 · Atualizado 2017-09-29 · CVE-2008-3164

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: fuzzylime (cms) versions 3.01 through 3.01a

Description: The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter when magic quotes gpc is disabled.

Recommendations: For versions 3.01 through 3.01a, consider disabling the execution of files using the file parameter in the blog.php script until a patch is available. Restrict access to the blog.php script to minimize the risk of exploitation. Avoid using the file parameter in the blog.php script until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3164

Produtos afetados

Fuzzylime

Referências · 9

• 🔥 https://exploit-db.com/exploits/6016 · Exploit
• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/30121.pl · Exploit
• 🔥 http://securityfocus.com/bid/30121 · Exploit
• 🔥 https://exploit-db.com/exploits/32016 · Exploit
• http://vupen.com/english/advisories/2008/2015/references · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43606 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43939 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3164 · Nota de Segurança
• http://secunia.com/advisories/30930 · Aviso do Fabricante