PT-2009-1355 · Phpclanwebsite · Phpclanwebsite

S4Avrd0W · Publicado 2009-01-08 · Atualizado 2017-09-29 · CVE-2008-5878

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phpclanwebsite versions 1.23.3 Fix Pack 5 and earlier

Description The issue allows remote attackers to include and execute arbitrary files via directory traversal vulnerabilities. This is possible when magic quotes gpc is disabled and register globals is enabled. The vulnerabilities can be exploited through the boxname parameter to "theme/superchrome/box.php" and the theme parameter to "phpclanwebsite/footer.php".

Recommendations For Phpclanwebsite versions 1.23.3 Fix Pack 5 and earlier, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk of exploitation. Additionally, restrict access to the box.php and footer.php files until a patch is available. Avoid using the boxname and theme parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5878

Produtos afetados

Phpclanwebsite

Referências · 5

• 🔥 https://exploit-db.com/exploits/7515 · Exploit
• 🔥 http://securityfocus.com/bid/32915 · Exploit
• http://secunia.com/advisories/33211 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5878 · Nota de Segurança
• http://securityreason.com/securityalert/4881 · Nota