PT-2009-1787 · Phpaddedit · Phpaddedit

Nuclear · Publicado 2009-02-27 · Atualizado 2017-09-29 · CVE-2008-6313

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: phpAddEdit version 1.3

Description: The issue allows remote attackers to include and execute arbitrary local files via a URL in the editform parameter when magic quotes gpc is disabled. This could also lead to PHP remote file inclusion attacks.

Recommendations: For phpAddEdit version 1.3, consider disabling the addedit-render.php script or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent exploitation. Avoid using the editform parameter in the affected script until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-6313

Produtos afetados

Phpaddedit

Referências · 5

• 🔥 http://securityfocus.com/bid/32774 · Exploit
• 🔥 https://exploit-db.com/exploits/7417 · Exploit
• http://secunia.com/advisories/33027 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6313 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47262 · Nota