PT-2010-1442 · Unknown · Advanced Comment System

Publicado 2010-01-18 · Atualizado 2021-02-08 · CVE-2009-4623

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Advanced Comment System version 1.0

Description The issue allows remote attackers to execute arbitrary PHP code via a URL in the ACS path parameter to API endpoints such as "index.php" and "admin.php" in the advanced comment system/ directory. This might only be a vulnerability when the administrator has not followed installation instructions in install.php.

Recommendations For Advanced Comment System version 1.0, ensure that the administrator follows the installation instructions in install.php to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the ACS path parameter in the affected API endpoints until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-4623

Produtos afetados

Advanced Comment System

Referências · 5

• 🔥 http://exploit-db.com/exploits/9623 · Exploit
• 🔥 https://exploit-db.com/exploits/9623 · Exploit
• http://secunia.com/advisories/36643 · Aviso do Fabricante
• https://t.me/cvenotify/9571 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2009-4623 · Nota de Segurança