PT-2008-6715 · Kusaba · Kusaba

Sausage · Publicado 2008-12-18 · Atualizado 2017-09-29 · CVE-2008-5663

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kusaba versions 1.0.4 and earlier

Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load receiver.php or (2) a shipainter action to paint save.php, then accessing the uploaded file via a direct request to this file in their user directory.

Recommendations For Kusaba versions 1.0.4 and earlier, consider restricting access to load receiver.php and paint save.php to prevent unauthorized file uploads until a fix is available. As a temporary workaround, restrict the shipainter action to minimize the risk of exploitation. Avoid allowing users to upload files with executable extensions.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-5663

Produtos afetados

Kusaba

Referências · 8

• 🔥 https://exploit-db.com/exploits/6711 · Exploit
• 🔥 https://exploit-db.com/exploits/6706 · Exploit
• http://securityfocus.com/bid/31668 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45794 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45793 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5663 · Nota de Segurança
• http://securityreason.com/securityalert/4782 · Nota
• http://securityfocus.com/bid/31685 · Aviso do Fabricante