PT-2008-6315 · Phpblaster · Phpblaster Cms

Cracker · Publicado 2008-11-19 · Atualizado 2017-09-29 · CVE-2008-5171

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions phpBLASTER CMS version 1.0 RC1

Description The issue concerns directory traversal vulnerabilities in the admin/minibb/index.php file of phpBLASTER CMS. When register globals is enabled, remote attackers can include and execute arbitrary local files using directory traversal sequences in the DB, lang, and skin parameters.

Recommendations For phpBLASTER CMS version 1.0 RC1, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the admin/minibb/index.php file and its parameters, specifically DB, lang, and skin, until a patch is available. Avoid using directory traversal sequences in these parameters to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5171

Produtos afetados

Phpblaster Cms

Referências · 3

• 🔥 https://exploit-db.com/exploits/5952 · Exploit
• http://securityfocus.com/bid/29983 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5171 · Nota de Segurança