PT-2008-5950 · Plugspace · Plugspace

Dun · Publicado 2008-10-24 · Atualizado 2017-09-29 · CVE-2008-4739

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PlugSpace version 0.1

Description The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting a directory traversal vulnerability in the index.php file when the magic quotes gpc setting is disabled. The vulnerability can be triggered by including a .. (dot dot) in the navi parameter of a specific API endpoint, although the exact endpoint is not specified.

Recommendations For PlugSpace version 0.1, consider disabling the execution of arbitrary local files or restricting access to the navi parameter until a patch is available. Additionally, enabling magic quotes gpc may help mitigate this issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-4739

Produtos afetados

Plugspace

Referências · 5

• 🔥 https://exploit-db.com/exploits/6602 · Exploit
• 🔥 http://secunia.com/advisories/32033 · Exploit
• 🔥 http://securityfocus.com/bid/31457 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4739 · Nota de Segurança
• http://securityreason.com/securityalert/4475 · Nota