PT-2009-3219 · Flatnux · Flatnux Cms

Alfons Luja · Publicado 2009-02-13 · Atualizado 2018-10-10 · CVE-2009-0572

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FlatnuX CMS (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary PHP code when register globals is enabled and magic quotes gpc is disabled. This can be achieved by providing a URL in the FNROOTPATH parameter to specific API endpoints, such as "index.php" and "filemanager.php".

Recommendations For all affected versions, ensure register globals is disabled and magic quotes gpc is enabled to prevent exploitation. As a temporary workaround, consider restricting access to the "index.php" and "filemanager.php" endpoints until the issue is resolved. Avoid using the FNROOTPATH parameter in these endpoints until the issue is fixed.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0572

Produtos afetados

Flatnux Cms

Referências · 8

• 🔥 http://securityfocus.com/bid/33599 · Exploit
• 🔥 https://exploit-db.com/exploits/7969 · Exploit
• http://secunia.com/advisories/33721 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48491 · Nota
• http://securityfocus.com/archive/1/500663/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0572 · Nota de Segurança
• http://osvdb.org/51729 · Nota
• http://osvdb.org/51728 · Nota