PT-2009-3284 · Php · Simple Php News

Osirys · Publicado 2009-02-18 · Atualizado 2017-09-29 · CVE-2009-0643

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple PHP News version 1.0 final

Description The issue allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter in post.php, which can then be executed by making a direct request to "display.php".

Recommendations For Simple PHP News version 1.0 final, consider restricting access to the post parameter in post.php to prevent code injection, and avoid using the display.php endpoint to execute arbitrary code until a fix is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0643

Produtos afetados

Simple Php News

Referências · 6

• 🔥 https://exploit-db.com/exploits/7999 · Exploit
• http://secunia.com/advisories/33814 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/0357 · Nota
• http://osvdb.org/51816 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0643 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48829 · Nota