PT-2010-2783 · Phpkobo · Phpkobo Free Real Estate Contact Form

Pouya Daneshmand · Publicado 2010-03-23 · Atualizado 2010-03-24 · CVE-2010-1062

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Phpkobo Free Real Estate Contact Form version 1.09

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG CODE parameter when magic quotes gpc is disabled.

Recommendations For Phpkobo Free Real Estate Contact Form version 1.09, consider disabling the LANG CODE parameter or restricting its use until a patch is available. Additionally, enabling magic quotes gpc may help mitigate the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-1062

Produtos afetados

Phpkobo Free Real Estate Contact Form

Referências · 6

• 🔥 http://securityfocus.com/bid/38731 · Exploit
• 🔥 http://exploit-db.com/exploits/11773 · Exploit
• 🔥 https://exploit-db.com/exploits/11773 · Exploit
• 🔥 http://packetstormsecurity.org/1003-exploits/frecf-lfi.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1062 · Nota de Segurança
• http://secunia.com/advisories/38967 · Aviso do Fabricante