PT-2009-3895 · Mozilo · Mozilocms

Sirgod · Publicado 2009-04-22 · Atualizado 2017-09-29 · CVE-2009-1369

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions moziloCMS version 1.11

Description The issue allows remote attackers to obtain sensitive information. This can be achieved via several parameters, including the gal[] parameter to "gallery.php", the page[] and cat[] parameters to "index.php", or the file[] parameter to "download.php". These parameters can reveal the installation path in an error message.

Recommendations For moziloCMS version 1.11, consider restricting access to the vulnerable parameters gal[], page[], cat[], and file[] in their respective scripts until a patch is available. As a temporary workaround, avoid using these parameters in the affected API endpoints "gallery.php", "index.php", and "download.php" to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-1369

Produtos afetados

Mozilocms

Referências · 3

• 🔥 https://exploit-db.com/exploits/8394 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1369 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49811 · Nota