PT-2008-6072 · Tribiq · Tribiq Cms

Gold_M · Publicado 2008-11-04 · Atualizado 2017-10-19 · CVE-2008-4894

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tribiq CMS versions 5.0.10a through 5.0.12c

Description A directory traversal issue exists in the header.inc.php file, allowing remote attackers to include and execute arbitrary local files. This occurs when register globals is enabled and magic quotes gpc is disabled. The issue is exploited through directory traversal sequences in the template path parameter.

Recommendations For Tribiq CMS versions 5.0.10a through 5.0.12c, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the template path parameter in the affected header.inc.php file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-4894

Produtos afetados

Tribiq Cms

Referências · 6

• 🔥 https://exploit-db.com/exploits/6888 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4894 · Nota de Segurança
• http://secunia.com/advisories/32548 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4894 · Nota
• http://securityfocus.com/bid/32018 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46264 · Nota