PT-2009-3233 · Phpbb · Pnphpbb2

Staker · Publicado 2009-02-16 · Atualizado 2017-09-29 · CVE-2009-0592

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PNphpBB2 versions 1.2i and earlier

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to various PHP files in the admin/ directory, including "admin words.php", "admin groups reapir.php", "admin smilies.php", "admin ranks.php", "admin styles.php", and "admin users.php".

Recommendations For PNphpBB2 versions 1.2i and earlier, consider restricting access to the admin/ directory and its files, such as "admin words.php", "admin groups reapir.php", "admin smilies.php", "admin ranks.php", "admin styles.php", and "admin users.php", to minimize the risk of exploitation. Avoid using the ModName parameter in these files until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-0592

Produtos afetados

Pnphpbb2

Referências · 4

• 🔥 https://exploit-db.com/exploits/7658 · Exploit
• 🔥 http://securityfocus.com/bid/33103 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0592 · Nota de Segurança
• http://secunia.com/advisories/33365 · Aviso do Fabricante