PT-2009-4404 · Unclassified · Unclassified Newsboard

Girex · Publicado 2009-06-05 · Atualizado 2017-09-29 · CVE-2009-1948

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Unclassified NewsBoard (UNB) version 1.6.4

Description: The issue allows remote attackers to read arbitrary recently-modified files or include and execute arbitrary local files due to directory traversal vulnerabilities in the forum.php file. This occurs when register globals is enabled and magic quotes gpc is disabled. The attack can be performed by exploiting the GLOBALS[filename] parameter or the GLOBALS[UTE][ tplCollection][a][file] parameter using a .. (dot dot) sequence.

Recommendations: For Unclassified NewsBoard (UNB) version 1.6.4, consider disabling the register globals setting and enabling magic quotes gpc to prevent exploitation. Additionally, restrict access to the forum.php file and its parameters, such as GLOBALS[filename] and GLOBALS[UTE][ tplCollection][a][file], to minimize the risk of directory traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-1948

Produtos afetados

Unclassified Newsboard

Referências · 6

• 🔥 https://exploit-db.com/exploits/8841 · Exploit
• 🔥 http://securityfocus.com/bid/35183 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50878 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1948 · Nota de Segurança
• http://secunia.com/advisories/35299 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50877 · Nota