PT-2008-6840 · Joomla · Com Competitions

Noge · Publicado 2008-12-31 · Atualizado 2017-09-29 · CVE-2008-5790

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions com competitions version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This can be achieved by manipulating the GLOBALS[mosConfig absolute path] parameter in add.php and competitions.php files located in the includes/competitions/ directory, and the mosConfig absolute path parameter in the settings.php file within the includes/settings/ directory.

Recommendations For com competitions version 1.0, consider restricting access to the add.php, competitions.php, and settings.php files until a patch is available. As a temporary workaround, avoid using the GLOBALS[mosConfig absolute path] and mosConfig absolute path parameters in the affected API endpoints.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-5790

Produtos afetados

Com Competitions

Referências · 3

• 🔥 https://exploit-db.com/exploits/7039 · Exploit
• 🔥 http://securityfocus.com/bid/32192 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5790 · Nota de Segurança