PT-2009-1413 · Modx · Modx Cms

Romancyxhacker · Publicado 2009-01-22 · Atualizado 2017-09-29 · CVE-2008-5938

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MODx CMS versions 0.9.6.2 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code when magic quotes gpc is disabled. This is achieved via a URL in the reflect base parameter.

Recommendations For MODx CMS versions 0.9.6.2 and earlier, consider disabling the reflect snippet or restricting access to the assets/snippets/reflect/snippet.reflect.php file until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-5938

Produtos afetados

Modx Cms

Referências · 9

• 🔥 http://securityfocus.com/bid/32436 · Exploit
• 🔥 https://exploit-db.com/exploits/7204 · Exploit
• http://vupen.com/english/advisories/2008/3236 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5938 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46797 · Nota
• http://securityreason.com/securityalert/4940 · Nota
• http://secunia.com/advisories/32824 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5938 · Nota
• http://svn.modxcms.com/svn/tattoo/tattoo/releases/0.9.6.3/install/changelog.txt · Aviso do Fabricante