PT-2009-1395 · Websvn · Websvn

James Bercegay · Publicado 2009-01-21 · Atualizado 2017-09-29 · CVE-2008-5920

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebSVN versions 1.x

Description The issue allows remote attackers to execute arbitrary PHP code via a crafted username that is processed by the preg replace function with the eval switch. This is due to a problem in the create anchors function in utils.inc.

Recommendations For WebSVN version 1.x, consider disabling the create anchors function in utils.inc until a patch is available to prevent the execution of arbitrary PHP code. Restrict access to the preg replace function with the eval switch to minimize the risk of exploitation. Avoid using the username variable in the affected function until the issue is resolved.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-5920

Produtos afetados

Websvn

Referências · 7

• 🔥 https://exploit-db.com/exploits/6822 · Exploit
• 🔥 http://securityfocus.com/bid/31891 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5920 · Nota
• http://securityreason.com/securityalert/4928 · Nota
• http://gulftech.org/?node=research&article_id=00132-10202008 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48168 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5920 · Nota de Segurança