PT-2008-6665 · Simpleforum · Simpleforum

Condemned · Publicado 2008-12-16 · Atualizado 2017-09-29 · CVE-2008-5604

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions My Simple Forum versions 3.0 through 4.1

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter in index.php when magic quotes gpc is disabled.

Recommendations For My Simple Forum versions 3.0 through 4.1, consider disabling the execution of files through the action parameter in index.php until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using the action parameter with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5604

Produtos afetados

Simpleforum

Referências · 7

• 🔥 https://exploit-db.com/exploits/7342 · Exploit
• http://osvdb.org/50433 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47097 · Nota
• http://securityfocus.com/bid/32643 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5604 · Nota de Segurança
• http://securityreason.com/securityalert/4765 · Nota
• http://secunia.com/advisories/32984 · Aviso do Fabricante