PT-2009-1983 · Aphpkb · Andy'S Php Knowledgebase

Cwh Underground · Publicado 2009-03-24 · Atualizado 2017-09-29 · CVE-2008-6513

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Andy's PHP Knowledgebase (aphpkb) version 0.92.9

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to saa.php, then accessing it via a link listed by authors.php.

Recommendations For version 0.92.9, consider restricting or disabling file uploads in saa.php to prevent exploitation until a fix is available. As a temporary workaround, restrict access to authors.php to minimize the risk of linking to maliciously uploaded files. Avoid using executable file extensions in uploads to saa.php until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-6513

Produtos afetados

Andy'S Php Knowledgebase

Referências · 6

• 🔥 https://exploit-db.com/exploits/7312 · Exploit
• http://secunia.com/advisories/34476 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46977 · Nota
• http://sourceforge.net/project/shownotes.php?group_id=113755&release_id=667918 · Correção
• http://securityfocus.com/bid/32559 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6513 · Nota de Segurança