PT-2008-5067 · Cyboards · Cyboards Php Lite
C R A C K E R
·
Publicado
2008-08-19
·
Atualizado
2017-08-08
·
CVE-2008-3707
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
CyBoards PHP Lite version 1.21
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in the
script path parameter to various PHP files, including (1) "flat read.php", (2) "post.php", (3) "process post.php", (4) "process search.php", (5) "forum.php", (6) "process subscribe.php", (7) "read.php", (8) "search.php", (9) "subscribe.php" in the path/, and (10) "add ban.php", (11) "add ban form.php", (12) "add board.php", (13) "add vip.php", (14) "add vip form.php", (15) "copy ban.php", (16) "copy vip.php", (17) "delete ban.php", (18) "delete board.php", (19) "delete messages.php", (20) "delete vip.php", (21) "edit ban.php", (22) "edit board.php", (23) "edit vip.php", (24) "index.php", (25) "lock messages.php", (26) "login.php", (27) "modify ban list.php", (28) "modify vip list.php", (29) "move messages.php", (30) "process add board.php", (31) "process ban.php", (32) "process delete ban.php", (33) "process delete board.php", (34) "process delete messages.php", (35) "process delete vip.php", (36) "process edit board.php", (37) "process lock messages.php", (38) "process login.php", (39) "process move messages.php", (40) "process sticky messages.php", (41) "process vip.php", and (42) "sticky messages.php" in the path/adminopts.Recommendations
As a temporary workaround, consider disabling the
script path parameter in the affected PHP files until a patch is available.
Restrict access to the vulnerable PHP files to minimize the risk of exploitation.
Avoid using the script path parameter in the affected API endpoints until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cyboards Php Lite