PT-2008-4931 · Wsn · Wsn Forum+4

Otmorozok428 · Publicado 2008-08-08 · Atualizado 2017-09-29 · CVE-2008-3555

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WSN Forum versions 4.1.43 and earlier Gallery versions 4.1.30 and earlier Knowledge Base (WSNKB) versions 4.1.36 and earlier Links versions 4.1.44 and earlier Classifieds versions prior to 4.1.30

Description A directory traversal issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter. This can be exploited by uploading a file, such as a .jpg file, containing PHP sequences.

Recommendations For WSN Forum versions 4.1.43 and earlier, update to a version later than 4.1.43. For Gallery versions 4.1.30 and earlier, update to a version later than 4.1.30. For Knowledge Base (WSNKB) versions 4.1.36 and earlier, update to a version later than 4.1.36. For Links versions 4.1.44 and earlier, update to a version later than 4.1.44. For Classifieds versions prior to 4.1.30, update to version 4.1.30 or later. As a temporary workaround, consider restricting access to the TID parameter in the affected index.php file until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3555

Produtos afetados

Aj Classifieds

Gallery

Wp Knowledgebase

Links

Wsn Forum

Referências · 6

• 🔥 https://exploit-db.com/exploits/6208 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3555 · Nota de Segurança
• http://secunia.com/advisories/31392 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44236 · Nota
• http://securityreason.com/securityalert/4120 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3555 · Nota