PT-2010-2496 · Jquery Foundation+2 · Jquery+2

Publicado 2010-02-27 · Atualizado 2010-03-01 · CVE-2010-0760

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Core Design Scriptegrator plugin version 1.4.1 for Joomla!

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences. This can be achieved through the "file" parameter to "libraries/jquery/js/ui/jsloader.php" and the "files[]" parameter to "libraries/jquery/js/jsloader.php".

Recommendations For Core Design Scriptegrator plugin version 1.4.1, consider disabling access to the "libraries/jquery/js/ui/jsloader.php" and "libraries/jquery/js/jsloader.php" scripts until a patch is available. Avoid using the file and files[] parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-0760

Produtos afetados

Core Design Scriptegrator

Joomla!

Jquery

Referências · 5

• 🔥 https://exploit-db.com/exploits/11498 · Exploit
• http://osvdb.org/62485 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0760 · Nota de Segurança
• http://secunia.com/advisories/38637 · Aviso do Fabricante
• http://osvdb.org/62484 · Nota