PT-2008-5717 · Crux · Crux Gallery

Pepelux · Publicado 2008-10-08 · Atualizado 2018-10-11 · CVE-2008-4484

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Crux Gallery versions 1.32 and earlier

Description: The issue allows remote attackers to gain administrative access. This can be achieved by setting the name parameter to "users" in the main.php file, as demonstrated via the index.php endpoint.

Recommendations: For Crux Gallery versions 1.32 and earlier, avoid using the name parameter in the main.php file until the issue is resolved. As a temporary workaround, consider restricting access to the main.php file to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-4484

Produtos afetados

Crux Gallery

Referências · 8

• 🔥 https://exploit-db.com/exploits/6586 · Exploit
• http://securityreason.com/securityalert/4365 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45443 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4484 · Nota de Segurança
• http://attrition.org/pipermail/vim/2008-October/002083.html · Nota
• http://secunia.com/advisories/32058 · Aviso do Fabricante
• http://securityfocus.com/archive/1/496763/100/0/threaded · Nota
• http://securityfocus.com/bid/31430 · Nota