PT-2009-1647 · Joomla · Rwcards

Vrs-Hck · Publicado 2009-02-19 · Atualizado 2017-09-29 · CVE-2008-6172

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RWCards (com rwcards) version 3.0.11

Description A directory traversal issue exists in the captcha/captcha image.php file of the RWCards component for Joomla!. This issue allows remote attackers to include and execute arbitrary local files when magic quotes gpc is disabled. The attack is performed by using directory traversal sequences in the img parameter of a vulnerable API endpoint, such as "/captcha/captcha image.php".

Recommendations For RWCards (com rwcards) version 3.0.11, consider disabling the captcha image.php file until a patch is available, or enable magic quotes gpc to prevent the exploitation of this issue. Restrict access to the captcha/captcha image.php file to minimize the risk of exploitation. Avoid using the img parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-6172

Produtos afetados

Rwcards

Referências · 5

• 🔥 http://securityfocus.com/bid/31892 · Exploit
• 🔥 https://exploit-db.com/exploits/6817 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46081 · Nota
• http://secunia.com/advisories/32367 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6172 · Nota de Segurança