PT-2008-6843 · Joomla · Clickheat

Noge · Publicado 2008-12-31 · Atualizado 2017-09-29 · CVE-2008-5793

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Clickheat - Heatmap stats (com clickheat) component version 1.0.1 for Joomla!

Description The issue allows remote attackers to execute arbitrary PHP code via specific parameters in various PHP files. This is achieved by providing a URL in the GLOBALS[mosConfig absolute path] parameter to files such as install.clickheat.php, Cache.php, Clickheat Heatmap.php, and GlobalVariables.php, and the mosConfig absolute path parameter to files like main.php, main.php, and main.php in the includes/overview directory.

Recommendations For Clickheat - Heatmap stats (com clickheat) component version 1.0.1, consider disabling the install.clickheat.php, Cache.php, Clickheat Heatmap.php, GlobalVariables.php, main.php, and main.php files until a patch is available to prevent remote attackers from executing arbitrary PHP code. Restrict access to the includes/heatmap and includes/overview directories to minimize the risk of exploitation. Avoid using the mosConfig absolute path and GLOBALS[mosConfig absolute path] parameters in the affected files until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-5793

Produtos afetados

Clickheat

Referências · 5

• 🔥 http://securityfocus.com/bid/32190 · Exploit
• 🔥 https://exploit-db.com/exploits/7038 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46439 · Nota
• http://securityreason.com/securityalert/4841 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5793 · Nota de Segurança