PT-2009-1986 · Phpkf · Phpkf-Portal

Publicado 2009-03-25 · Atualizado 2017-08-17 · CVE-2008-6516

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpKF-Portal version 1.10

Description The issue allows remote attackers to include arbitrary files via directory traversal vulnerabilities. This can be achieved by including a .. (dot dot) in the tema dizin parameter to "baslik.php" or the portal ayarlarportal dili parameter to "anket yonetim.php".

Recommendations For phpKF-Portal version 1.10, restrict access to the baslik.php and anket yonetim.php scripts to minimize the risk of exploitation. Avoid using the tema dizin and portal ayarlarportal dili parameters in the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-6516

Produtos afetados

Phpkf-Portal

Referências · 5

• 🔥 http://securityfocus.com/bid/30566 · Exploit
• 🔥 https://exploit-db.com/exploits/32182 · Exploit
• 🔥 https://exploit-db.com/exploits/32183 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6516 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44263 · Nota