PT-2009-2000 · Ezonescripts · Ezonescripts Living Local

Bgh7 · Publicado 2009-03-26 · Atualizado 2017-09-29 · CVE-2008-6530

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eZoneScripts Living Local version 1.1

Description The issue allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension to the editimage.php file, and then accessing it via a direct request to the uploaded file. This can be achieved by exploiting an unrestricted file upload vulnerability.

Recommendations For version 1.1, restrict access to the editimage.php file to prevent unauthorized file uploads, and consider implementing validation to only allow uploading of files with specific, non-executable extensions. As a temporary workaround, consider disabling the file upload functionality in editimage.php until a more comprehensive fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2008-6530

Produtos afetados

Ezonescripts Living Local

Referências · 4

• 🔥 http://securityfocus.com/bid/32760 · Exploit
• 🔥 https://exploit-db.com/exploits/7408 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6530 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47215 · Nota