PT-2009-6264 · Php · Php Traverser

Publicado 2009-11-27 · Atualizado 2017-08-17 · CVE-2009-4085

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP Traverser version 0.8.0

Description A remote file inclusion issue exists, allowing remote attackers to execute arbitrary PHP code via a URL in the BASE parameter within the GLOBALS array. This can be achieved by manipulating the URL to include malicious PHP code.

Recommendations For PHP Traverser version 0.8.0, consider restricting access to the mp3 id.php file in the assets/plugins/mp3 id directory to minimize the risk of exploitation. As a temporary workaround, avoid using the BASE parameter in the GLOBALS array until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-4085

Produtos afetados

Php Traverser

Referências · 5

• 🔥 https://exploit-db.com/exploits/10219 · Exploit
• http://secunia.com/advisories/37455 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54378 · Nota
• http://osvdb.org/60466 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4085 · Nota de Segurança