PT-2009-1764 · Niclor · Niclor Sito

Staker · Publicado 2009-02-26 · Atualizado 2017-09-29 · CVE-2008-6290

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: nicLOR Sito (affected versions not specified)

Description: The issue allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the page file parameter in includefile.php, particularly when register globals is enabled or magic quotes gpc is disabled.

Recommendations: For all affected versions, consider disabling the register globals setting and enabling magic quotes gpc to minimize the risk of exploitation. As a temporary workaround, restrict access to the includefile.php file to prevent remote attackers from including and executing arbitrary files. Avoid using the page file parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-6290

Produtos afetados

Niclor Sito

Referências · 5

• 🔥 https://exploit-db.com/exploits/6990 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6290 · Nota de Segurança
• http://securityfocus.com/bid/32111 · Nota
• http://secunia.com/advisories/32556 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46338 · Nota