PT-2009-3170 · Php · Phpslash

Darkfig · Publicado 2009-02-11 · Atualizado 2018-10-11 · CVE-2009-0517

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions phpSlash versions 0.8.1.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval() function call within the generic function in include/class/tz env.class.

Recommendations For phpSlash versions 0.8.1.1 and earlier, consider disabling the eval() function call within the generic function in include/class/tz env.class as a temporary workaround until a patch is available. Restrict access to the fields parameter in the affected API endpoint to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0517

Produtos afetados

Phpslash

Referências · 7

• 🔥 http://securityfocus.com/bid/33572 · Exploit
• 🔥 https://exploit-db.com/exploits/7948 · Exploit
• http://securityfocus.com/archive/1/500664/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0517 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48441 · Nota
• http://secunia.com/advisories/33717 · Aviso do Fabricante
• http://osvdb.org/51727 · Nota