PT-2010-2152 · Bits · Bits Video Script

Publicado 2010-01-21 · Atualizado 2017-08-17 · CVE-2010-0366

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Bits Video Script versions 2.04 through 2.05 Gold Beta

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to certain API endpoints, specifically through the files register.php and addvideo.php, and then accessing the uploaded file directly.

Recommendations For versions 2.04 through 2.05 Gold Beta, consider disabling the file upload functionality in register.php and addvideo.php until a patch is available to prevent remote code execution. Restrict access to the directories where uploaded files are stored to minimize the risk of exploitation. Avoid using executable file extensions for uploads in the affected API endpoints until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-0366

Produtos afetados

Bits Video Script

Referências · 7

• 🔥 https://exploit-db.com/exploits/34120 · Exploit
• 🔥 http://packetstormsecurity.com/1001-exploits/bitsvs-xssuploadrfi.txt · Exploit
• 🔥 https://exploit-db.com/exploits/34119 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55738 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0366 · Nota de Segurança
• http://secunia.com/advisories/38252 · Aviso do Fabricante
• http://osvdb.org/61826 · Nota