PT-2009-2648 · Unknown · Butterfly Organizer

Stack · Publicado 2009-09-08 · Atualizado 2017-09-29 · CVE-2008-7181

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Butterfly Organizer version 2.0.0

Description The issue allows remote attackers to perform unauthorized actions. This includes deleting arbitrary categories by modifying the tablehere parameter in the "category-delete.php" endpoint with is js confirmed set to 1, or deleting arbitrary accounts via the mytable parameter in the "delete.php" endpoint.

Recommendations For Butterfly Organizer version 2.0.0, as a temporary workaround, consider restricting access to the "category-delete.php" and "delete.php" endpoints until a patch is available. Avoid using the tablehere and mytable parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-7181

Produtos afetados

Butterfly Organizer

Referências · 4

• 🔥 https://exploit-db.com/exploits/5800 · Exploit
• 🔥 http://securityfocus.com/bid/29703 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-7181 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43067 · Nota