PT-2009-1441 · Globsy · Globsy

Staker · Publicado 2009-01-26 · Atualizado 2017-09-29 · CVE-2008-5966

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Globsy versions 1.0 and earlier

Description The issue allows remote attackers to create or overwrite arbitrary files. This is achieved by specifying a filename in the file parameter and providing file contents in the data parameter in the globsy edit.php file.

Recommendations For Globsy versions 1.0 and earlier, consider restricting access to the globsy edit.php file until a fix is available, and avoid using the file and data parameters in this file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-5966

Produtos afetados

Globsy

Referências · 4

• 🔥 http://securityfocus.com/bid/31727 · Exploit
• 🔥 https://exploit-db.com/exploits/6735 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5966 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48324 · Nota