PT-2008-5083 · Phpizabi · Phpizabi

Publicado 2008-08-20 · Atualizado 2017-08-08 · CVE-2008-3723

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Média

Vetor base

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPizabi version 0.848b C1 HFP3

Description The issue allows remote authenticated administrators to read arbitrary files. This can be achieved via the id parameter in an admin.templates.edittemplate action by using a .. (dot dot), a URL, or possibly a full pathname.

Recommendations For PHPizabi version 0.848b C1 HFP3, consider restricting access to the admin.templates.edittemplate action to minimize the risk of exploitation. As a temporary workaround, avoid using the id parameter in this action until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3723

Produtos afetados

Phpizabi

Referências · 7

• 🔥 https://exploit-db.com/exploits/32251 · Exploit
• 🔥 http://lostmon.blogspot.com/2008/08/phpizabi-v0848b-traversal-file-access.html · Exploit
• 🔥 http://packetstormsecurity.org/0808-exploits/phpizabi-traverse.txt · Exploit
• 🔥 http://securityfocus.com/bid/30707 · Exploit
• http://secunia.com/advisories/31533 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3723 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44509 · Nota