PT-2008-4903 · Lovecms · Lovecms

Pomdapimp · Publicado 2008-08-07 · Atualizado 2017-09-29 · CVE-2008-3509

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LoveCMS version 1.6.2

Description The issue allows remote attackers to change the configuration or execute arbitrary PHP code due to the lack of administrative authentication for certain files in the system/admin/ directory. Specifically, this affects the addblock.php, blocks.php, and themes.php files.

Recommendations For LoveCMS version 1.6.2, consider restricting access to the addblock.php, blocks.php, and themes.php files in the system/admin/ directory until a patch is available. As a temporary workaround, implement proper administrative authentication for these files to prevent unauthorized changes or code execution.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-3509

Produtos afetados

Lovecms

Referências · 7

• 🔥 https://exploit-db.com/exploits/6209 · Exploit
• 🔥 https://exploit-db.com/exploits/6210 · Exploit
• http://securityfocus.com/bid/30562 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44227 · Nota
• http://secunia.com/advisories/31389 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3509 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44226 · Nota