PT-2008-5682 · Positive · H-Sphere Webshell

Publicado 2008-10-06 · Atualizado 2017-08-08 · CVE-2008-4448

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Positive Software H-Sphere WebShell version 4.3.10

Description: A cross-site request forgery (CSRF) issue allows remote attackers to perform unauthorized actions as an administrator. This includes file deletion and creation via a link or IMG tag to certain actions, such as overkill, futils, or edit actions.

Recommendations: For Positive Software H-Sphere WebShell version 4.3.10, consider implementing CSRF protection mechanisms to prevent unauthorized actions. As a temporary workaround, restrict access to the actions.php file and its associated actions until a patch is available. Avoid using links or IMG tags that could trigger the overkill, futils, or edit actions in the affected API endpoint until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-4448

Produtos afetados

H-Sphere Webshell

Referências · 4

• 🔥 http://packetstormsecurity.org/0810-exploits/webshell431-xssxsrf.txt · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45614 · Nota
• http://secunia.com/advisories/32086 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4448 · Nota de Segurança