PT-2009-3076 · Phplist · Phplist

Publicado 2009-02-05 · Atualizado 2018-10-11 · CVE-2009-0422

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phplist versions 2.10.8 and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the SERVER[ConfigFile] parameter to admin/index.php. This is possible when register globals is disabled.

Recommendations For phplist versions 2.10.8 and earlier, consider disabling the admin/index.php endpoint until a patch is available. Restrict access to the lists/admin.php file to minimize the risk of exploitation. Avoid using the SERVER[ConfigFile] parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0422

Produtos afetados

Phplist

Referências · 7

• 🔥 http://bugreport.ir/index_60.htm · Exploit
• 🔥 https://exploit-db.com/exploits/7778 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0422 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47945 · Nota
• http://secunia.com/advisories/33533 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0422 · Nota
• http://securityfocus.com/archive/1/500057/100/0/threaded · Nota