PT-2008-4965 · Mozilo · Mozilocms

Ams · Publicado 2008-08-11 · Atualizado 2017-09-29 · CVE-2008-3589

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions moziloCMS version 1.10.1

Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the download.php file when magic quotes gpc is disabled. This is achieved by using a .. (dot dot) in the cat parameter.

Recommendations For moziloCMS version 1.10.1, consider disabling the download.php file or restricting access to it until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue. Avoid using the cat parameter in the download.php file until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3589

Produtos afetados

Mozilocms

Referências · 6

• 🔥 https://exploit-db.com/exploits/6194 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44162 · Nota
• http://securityreason.com/securityalert/4136 · Nota
• http://secunia.com/advisories/31327 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3589 · Nota de Segurança
• http://securityfocus.com/bid/30526 · Nota