PT-2009-6294 · Cutenews · Cutenews

Publicado 2009-11-30 · Atualizado 2018-10-10 · CVE-2009-4115

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews version 1.4.6

Description The issue allows remote authenticated users with administrative privileges to inject arbitrary PHP code. This can be achieved through the Categories module by injecting code into data/category.db.php via the category and Icon URL fields, or into data/ipban.php via the add ip parameter.

Recommendations For CuteNews version 1.4.6, consider disabling the Categories module until a patch is available to prevent arbitrary PHP code injection. Restrict access to the category and Icon URL fields, as well as the add ip parameter, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-4115

Produtos afetados

Cutenews

Referências · 5

• 🔥 https://exploit-db.com/exploits/1289 · Exploit
• 🔥 http://morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt · Exploit
• http://securityfocus.com/archive/1/507782/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4115 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54243 · Nota