PT-2009-4669 · Tribiq · Tribiq Cms

Cracker · Publicado 2009-06-26 · Atualizado 2017-09-19 · CVE-2009-2220

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tribiq CMS version 5.0.12c

Description The issue allows remote attackers to include and possibly execute arbitrary files via directory traversal sequences in certain parameters. This is possible when register globals is enabled and magic quotes gpc is disabled. The vulnerable parameters include template path in files such as "masthead.inc.php", "toppanel.inc.php", and "contact.inc.php" in the "templates/mytribiqsite/tribiq-CL-9000/includes" directory, and the use template family parameter in "nlarlist content.inc.php".

Recommendations For Tribiq CMS version 5.0.12c, consider disabling the register globals setting and enabling magic quotes gpc to mitigate the risk. Additionally, restrict access to the vulnerable files, such as "masthead.inc.php", "toppanel.inc.php", "contact.inc.php", and "nlarlist content.inc.php", to minimize the risk of exploitation. Avoid using the template path and use template family parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-2220

Produtos afetados

Tribiq Cms

Referências · 6

• 🔥 http://exploit-db.com/exploits/9012 · Exploit
• 🔥 https://exploit-db.com/exploits/9012 · Exploit
• 🔥 http://secunia.com/advisories/35535 · Exploit
• 🔥 http://securityfocus.com/bid/35484 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2220 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2220 · Nota