PT-2009-6547 · Ignition · Ignition

Condemned · Publicado 2009-12-28 · Atualizado 2017-08-17 · CVE-2009-4426

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ignition version 1.2

Description The issue concerns multiple directory traversal vulnerabilities. When magic quotes gpc is disabled, remote attackers can include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the blog parameter to specific API endpoints, such as "comment.php" and "view.php".

Recommendations For Ignition version 1.2, consider disabling the execution of files from user-inputted paths until a patch is available. Restrict access to the "comment.php" and "view.php" endpoints to minimize the risk of exploitation. Avoid using the blog parameter in these endpoints until the issue is resolved. Enable magic quotes gpc to prevent attackers from injecting malicious input.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-4426

Produtos afetados

Ignition

Referências · 8

• 🔥 http://packetstormsecurity.org/0912-exploits/ignition-lfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/10569 · Exploit
• 🔥 http://osvdb.org/61225 · Exploit
• 🔥 http://exploit-db.com/exploits/10569 · Exploit
• 🔥 http://osvdb.org/61226 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4426 · Nota de Segurança
• http://secunia.com/advisories/37836 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54940 · Nota