PT-2009-2559 · Pligg · Pligg

James Bercegay · Publicado 2009-08-26 · Atualizado 2018-10-11 · CVE-2008-7090

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pligg versions 9.9 and earlier

Description The issue allows remote attackers to determine the existence of arbitrary files or include arbitrary files via directory traversal vulnerabilities. This can be achieved by exploiting the $tb url variable in "trackback.php" or the template parameter in "settemplate.php" using a .. (dot dot) sequence.

Recommendations For Pligg versions 9.9 and earlier, as a temporary workaround, consider restricting access to the "trackback.php" and "settemplate.php" files until a patch is available. Avoid using the $tb url variable in "trackback.php" and the template parameter in "settemplate.php" with untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-7090

Produtos afetados

Pligg

Referências · 10

• 🔥 http://securityfocus.com/bid/30458 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00120-07312008 · Exploit
• 🔥 https://exploit-db.com/exploits/6173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7090 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44190 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44191 · Nota
• http://osvdb.org/50188 · Nota
• http://securityfocus.com/archive/1/494987/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7090 · Nota
• http://osvdb.org/50187 · Nota