PT-2009-1477 · Web-Cp · Web-Cp

Gold_M · Publicado 2009-01-28 · Atualizado 2017-09-29 · CVE-2008-6002

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions web-cp version 0.5.7

Description The issue allows remote attackers to read arbitrary files due to an absolute path traversal vulnerability in sendfile.php when register globals is enabled. This is achieved by providing a full pathname in the filelocation parameter.

Recommendations For web-cp version 0.5.7, consider disabling the sendfile.php script or restricting access to it until a patch is available. Additionally, disabling register globals can help mitigate the risk of exploitation. Avoid using the filelocation parameter in the affected script until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-6002

Produtos afetados

Web-Cp

Referências · 6

• 🔥 http://securityfocus.com/bid/31371 · Exploit
• 🔥 https://exploit-db.com/exploits/6556 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6002 · Nota de Segurança
• http://secunia.com/advisories/31979 · Aviso do Fabricante
• http://web-cp.net/mantis/changelog_page.php · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45408 · Nota