PT-2008-4940 · Dayfox · Dayfox Blog

Hadihadi · Publicado 2008-08-10 · Atualizado 2017-09-29 · CVE-2008-3564

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dayfox Blog version 4

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p, cat, and archive parameters in index.php. This can potentially be leveraged for remote file inclusion in certain environments by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Recommendations For Dayfox Blog version 4, consider restricting access to the p, cat, and archive parameters in index.php to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3564

Produtos afetados

Dayfox Blog

Referências · 5

• 🔥 https://exploit-db.com/exploits/6203 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3564 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44203 · Nota
• http://securityreason.com/securityalert/4122 · Nota
• http://securityfocus.com/bid/30538 · Nota