PT-2009-2625 · Ekin · Ekinboard

Eugene Minaev · Publicado 2009-09-02 · Atualizado 2017-09-29 · CVE-2008-7156

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EkinBoard versions 1.1.0 and earlier

Description The issue allows remote attackers to bypass authorization and gain administrator privileges. This can be achieved by setting the groups[] parameter to 2. An example of exploitation is via the backup.php endpoint.

Recommendations For EkinBoard versions 1.1.0 and earlier, consider disabling the register globals setting to prevent exploitation. Additionally, restrict access to the backup.php endpoint until a fix is available. As a temporary workaround, avoid using the groups[] parameter in sensitive operations until the issue is resolved.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-7156

Produtos afetados

Ekinboard

Referências · 4

• 🔥 http://securityfocus.com/bid/27166 · Exploit
• 🔥 https://exploit-db.com/exploits/4859 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39512 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7156 · Nota de Segurança