PT-2008-5256 · Cmme · Content Management Made Easy

Sirgod · Publicado 2008-09-04 · Atualizado 2017-09-29 · CVE-2008-3926

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Content Management Made Easy (CMME) version 1.12

Description The issue allows remote attackers to read arbitrary files or create arbitrary directories. This can be achieved by exploiting directory traversal vulnerabilities, specifically by using a .. (dot dot) in the env parameter. For file reading, this can be done in a weblog action to "index.php". For directory creation, this can be done in a login action to "admin.php".

Recommendations For Content Management Made Easy (CMME) version 1.12, consider restricting access to the env parameter in both the weblog action to "index.php" and the login action to "admin.php" to prevent directory traversal attacks. As a temporary workaround, restrict the use of the env parameter until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3926

Produtos afetados

Content Management Made Easy

Referências · 7

• 🔥 https://exploit-db.com/exploits/6313 · Exploit
• 🔥 http://securityfocus.com/bid/30854 · Exploit
• 🔥 http://secunia.com/advisories/31599 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3926 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44683 · Nota
• http://securityreason.com/securityalert/4220 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44687 · Nota